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ABSTRACT 

This paper proposes a system whittle when imolemenled,, ■*!!! be able 1o understand 
roatriemalical FORTRAN proems such as that? in 1he EBM Scientific Subroutine 
Package. The s-ystern 1ak*$, a$ input, a pri^ram and annotation of the program, [n 
orrjn 10 urvderstand the progrtirt, the system develops, a H plan H for it. The- ~pk*n" 
spoc^ias the purpose oF each f*.g.tur<t -of the program and ho* these feature*. 
COOperale in order 1o create Ihe behanor B*hibiled by tf* program. The system 
can us-e lis understanding of the protnm to answer questiors ahoul it instiling 
questions, about the ramifications cl a proposed modification, It is a':sO able to aid 
in debugging the program by OeietlinE; sr'Ors in il a and by localing th^ feature? Qi 
tKe program which are responsible tor a*, iff or, 7 he system should be of 
signify *n| assistance to a person who s writing a program. 
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I. A PROGRAM UNDERSTANDING SYSTEM 

This research prc.ec! .% concerned *iih waning and molerEn' ng a program undnrsiar.dng 
iyitem. This sect'On brielly describe* what the proposed system does, ho* j| does it. and why il is 
wOrlh doing. Sections IE and tit specify, irt grcaler detail, what 1he sysle™ does and how it does it. 
This paper speaks Of trip program understanding system in the present tense, However* il should tie 
noteo" 1bat the system has not boen implemenled yel. 

E.l BRIEFLY, WHAT THE SVS7tW DOES 

The system understands malhematical FORTRAN programs, 11 fleet net a1 tempt 1n understand 
the rnathematits embodied in a program, b«^t only the programming. A rnalhemalical program can be 
considered as tine implementation d a theorem. The SySSerr- does ntf 1ry to understand the Iheornm 
ll just believes il. What it does do, i* to understand ho* th ( program implements tne theorem.. 

Mathematical FORTRAN program* wore chosen as The domain because *hey are a 
slraighlforward 1ype o( program. They are real proems thai use onJy a smaJl subset Ol possible 
programming techniques. In p.BJti<u.l*r, lhey use only simple di1» types (numbers, arrays, functions}, 
simple (CnlrOl structure (no recursion, no asynchreny), sialic varices anc* ro 1/3. Furthermore, in 
the i3M SSP subroutine library, ihe^e are a large number of reasonably strirelured real programs to 
**rve as e*'pe*i menial dala dor th c system. These programs are a good test of a program 
understanding syslem, because 1hey were not specifically written 1o be understood by such a system. 
The system demonstrates iH undeTslandirg ol a program through its ability 10 perform several tasks 
which require underslaricir,;;. 

1.1.1 ANSWERING QUESTIONS ABOUT A PROGRAM 

The system is a-bte to answer questions about a program il understands, such asj 

b) What is this pari &F the program? 
b> Wfl?( does this part do? 

c) Why rs Ihis part here? 

d J What is fr* Function of thij part? 
eJ Wow does this pari oo what il does? 
f) What part aehi&ves tnis goal? 
In other words, i1 is able to explain a program, to imparl Ms untie-sla-di-^ of il 1o enot*ie'. 

3.1.2 DETECTING [INCONSISTENCES IN THE PROGRAM ATD [TS DESCRIPTION 

The System does not attempl to prove the eprrsctness of s program. However, it is able to 
dolcct simple incon-sis fences in its unde^s! adding. oF a program. E1 c-an detect a variety Of problems 
where it can be simply shown lhat a segn-cnt o< a program can not possibly achieve the results 
requcsled Ot it. The System's dedvtfiue apparatus consists largely 01 pahern mashing, ^d trial by 
en an- pie. This allows it to prove jfcajvy *st*rt£0ns false, bu1 iew correct, 

U,3 AIDING [N THE DETECTION AMD UNDERST AN&JNG OF BUGS 

The system can apply its understanding ol a program lo aid in the task ol debugging it. When 
running 1he program in a caraFut mode, the system constantly checks whether a con'radieliOn has 
arisen tdwcB.- its jm: standing cF the program, ard whal is actually happening. The moment a 
contradiction appears, the System reports it. This causes bugs !o be found closer la their poi.il o'„ 
origin than in an orcina.ry programming system. For example, She syslem might say "matrit A is net in 
hormetifln normal fo™ n rather than "zerodivide" iorty subroutine calls later. 

furl her, once gi^en a poml Of departs re, 1he system can trace bath av*n closer to the origin of 
the problem. For instance, after discovering thai matrix A was no! in hermctiOn normal form, the 
system might say "the subroulirte F is not living i-p lo its estt-'msic description^ which Claims that its 
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output ■& always- in herniation normal form" or "Jh? theorem implied by the use Of subroutine F that 
in/ mat rise wiih proper! ias Pi, P£ p *nd P3 is in hermetipn normal form, must be fife*,* 

[n shcrl, Ihe system pssists a user in backtracking i bug 1o lis source, and t>y watching The 
•tattulinn -closely, reduces Ihe amount Of bacKtrac*ng which needs to be dona. 

1-1,4 INVESTIGATING THE RAMlf ICAT TONS OF A MCDtFJCATOJ 

When a teaman' of code is. altered, to fix a bug Or add a leature, ;he system tan assess some 
pf the ramifications of the chan&e. This is particularly useful when I he changed segment served oth*r 
purposes in addition (o the one undtr cen&ideraliDi. The $ys!ern can as* ilselF whether 1he functions 
1he old. Sc-Emon; se-vect mrc sliJI beir\2 1iten care cF> whether 1he new goals interfere with other goals- 
ft( the program, and whelher the change does n la- achieve Ihe results intended o' it. 

1.2 BRIEFLY, HGW THE SYSTEM WORKS 

The system looks at a program as being comaosed of logically separate segments of COc!* which 
are combined lDg.e1her by connective lissui. Further, eHeh segment is composed nF s-ubsegments, e tc, 
The connective tissue it OF Iwc types, data 1low ror-ert.ve tiasu? (variables, tunclion parameters* 
assignment 5 }, and flow of control connective tissue [branches, subroutine caMs h sequential c&de 
placement). The dala Flow CQn.neclive liss.e tranr.mils fa\? ac-tween se&me'.ts, and Ihe cOn-trOJ (low 
cdnnectwe (issue executes the Segments; j n Ihe proper order, 

[.£.1 THE STRUCTURES WHICH DESCRIBE A PROGRAM 

The program as a whole is describee thrown ihe interaction oJ two types of descriptions: 
bihavioral descriptions ana plans. A othavioral cescriplipn jdcciIibs what a segment of codo does 
wifhoijl indicating hc-w it is done. It lists (he inputs, Outputs, prerequisites* ard output assertion* of a 
segment. Behavioral descriptions describe a Jegno-I J '=m two n^.or pom's of view. An intrinsic 
behavioral description lells what a segment docs m isolation. All the statements it makes about a 
segmtnt arc- true for every use ol the segment. An ¥*rrinsic behavioral desc* ipdon tells what a- use 
ft! a segment does in the consent of Ms use. One segment CU". be used for many logically unrelated 
I asks in the same proE*am. 

A plan indicates how several segments {and their axlrirsic behavioral descriptions} combine to 
farm p larger segment fand lis intrinsic benjvioraJ description?. Plans arc quile variable, but, 
Observalion indicates that they fall into a small number of 1ypes (around t*n>. This makes il aossihlc 
to deal wiih the plans even though each type is Sreated separately. ]t also means that a great oeal of 
information can be inferred abOul a segment purely IfOm lhe type d1 the plan lor the segment, since 
Ou1 of the vast array Ol possible plan types Only a small number are used. This in turn makes bolh 
recognizing end understanding a segment easier. 

The grand plan, wrtith completely describes Ihe operation of a peogfjwn, simply consists of 
behavioral descriptions and plans tor- every segrrenf down to some leval where the segments are 
takan as fundamental ano as navi.-j ■■-:■ ftub^gTi<?-l5 and hence no plans. 

1.2,2 HOW THE SYSTEM USES TtC DESCRLPTIYE STRUCTURES 

QjesliOns about a seg.rr,rrnl 3 re answered th/ough reference to tne descriptive structures. For 
examp e, "What SOcs Ih s do?" i± answered by reference to the behavioral deacriplion, "How does it 
do ii?" is answered by reference to the plan, "What funtlmn does it serve?* is answered by 
reference Id Ihe esctrinsie behavioral description a/vd Ihe plans in which it is contained. 

Detection of inconsistences is peHormed. while the description* are being constructed, As Ihe 
system builds up its understanding of a p-'o&rjm, t rci-li.-jally th&cht for inconsistences in what it 
knows. Whenever H d -stove -a or .% to d sOmet- n^ about the program, it attempts to verily \\. If it 
discovers a co-nlracJictiOrt, it reporls it, ]f it veiides it,, fine, tost o( the time however,, it comes 1o no 
conclusion, since 1he deductrva mechanism i$ weak Jn lhat case, it assumes that fhe fact is true, but 



s 



Richard C. Waters n , . „ nMi 

J 1. A PROGRAM UNDERSTANDING SYSTEM 

ii prepared to discfiver a | a | alBT tim , ha . t ,, c Jg£ . i$ c&ntrfldi ^ d 

.n,^;;:::; ^z^ltr^ ™ jn5 * ihe sy * iem bi ^ «■•« ->«** ** 

■whs winttc iy J; ?■■ ; -u J * si,ste,n m * s ** tiio ™ such aE - Hwh * re did ^ »«t f'**ri 
^:i:Z^^ D ; lh f b * ho wan * l1 * * ar * th * r w ^ 7h * -*— » t*™ »»iio™: 

tt<3 HOW THE DESCRIPTIVE STRUCTURES ARE BUILT UP 

user tafal 7^7^lT ** un*r S Hna.n B fit p pro g r affl based 0r > Eh* „de if»|f, and on w ha > Ihe 

^^t ;• t f z e ™^ «»«■ *■»■ -* * ^*'^ * w W t he Pf i'i,iv e i" 

i mi sysrsm car, ^ a Jo^g way Toward analyzing Ihe lower Iml tennis 

snd ... * "'"' n,usl pr ° ,Jde «"™- ! a*5criairt S Ihe av«r,l| be-a,.g- B d«cr p|it>n < 1hc prosram 

:Hhe^^:i^ Q t cr,pi,on ' cr the *»*" * - «•-*- »■**•< *» - ™r«,.o* 

knowledge of th, & t e r M , yped ,>!„ se ^ en , lypet ro aM|yi , thfi f ^ S use ' ! * 

si : r r : ™- -"*'•■ - - ----- v ssrr"™r r 

1.3 WHY THE 5YSTEU IB VALUftEL£ 

>™r, in"«hI U l'n D ,T; th& 7 Eteffl ** U ' d ^ * n a:d !n d - bu SBme, Bu £t ,e«m to be at tw fl lypes: 
errors ,n Ih* al B Dr-|hm. an* .rr4r S in the ir^lemenlatiar, ot the *l & ori1hrh. 7he 3ya |*n, woiwhS 

fforLl W?h.t \L : t ^ irj,ffln, * r P™^ * ** bus while fixing «n «| d on & , This i, gw »Bjr du 
15 FOrj|el|in B Ihjf . par htul flr sesm^l of CQOo has rnor* lhan on* function in Ihe proa™ 

In , imi it f f^hiDrts ihe tyste-n ifl-ads towd iuta ma tic j»rt S r»iwH.n B . A compile underslandina 
Th* only q ue 5 t iDrt « how c ,n the ^.rdmAll be d e , ekjped w^ut rel.rle to )he Sf, 
1.4 RELATIONSHIP TO OTHER WWK 

^,u Hi!* " cliDn . d0S " ifa « the fslalior^hip be1«-«n th* EyB te rt P r rtpa£ e a i n this p ipe r and oth^r 
worK P f rflm two p<,,n i4 of view. First, it C, m p,r eS ^ b*« ™th4«0 6 , of ^K 2Sr 
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approaches to -,he same Qvpra'l goal. Second, .1 compares 1his system with other systems usin & a 
Si malar methodoloey. While rr,akir, fl Ihese comparisona. it Iriea So trace |h c developmenl -of Ihe hey 
ideas crrbodieo in this system. 

tAl OTHER APPROACHES TO THE ?A^E GOAL 

Consider j user {programmer} whp wishes to perlOrm a certain cemputaliem. To do Ihis,,. he 
wTiIbs a program which will cause a digital cprr.pulc-r |p periprm I he confiuMhon. This reduces his 
work to Ihe wprK required to write the program. Iha basic goal of the research proposed in this 
paper is to reduce programming attOrt as much as zjossibla. 

Wrilme a program consists of 1wo intertwined taste, designing all at Ihe (totalis required to 
cause a COmpuler to perform a eornfiutiliefl, and showing at least ir-FOrmally, that this Mn-.fnjl5.l1Or, , 5 
the One the us.er had in mind. Designing the d>1 ails (producing the program) is what is usually 
referred to as wnling the program, However, it is dear |haF a programmer is continually guided by 
an informal feeling fox why whal he h 35 written and what he will w-riSe, is correct. 

1.44.1 GENERAL PURPOSE HIGH LEVEL LANGUAGES 

The first stop in reducing programing effort was achieved hy movmg IrOm machine code, 
through assembler language, to general purpose high level languages. The development Of these 
mare powerful languages 5 le mired frcn- two *ey ideas: rnoaulcs and absl Tactions, 

A pre -written module can be as simple a* a multiplied ion- routine or as complex as a data oas^ 
managernenl syslern. A module can ba used as a sufcrOuline or expanded mime 35 a macro. It can be 
partially pre-evalualed Or transferred aF1er instantiation 1o increase efficiency, In any case, modules 
reduce the 61101*1 required 1c wr.lc a program Decade key can pe (..:,:?:: *-;rsul having to he 
rewritlen. They reduce tne effort re-quired to verily a program because Ihey can be used as Eemmas 
in the verification without having to fre ^everiFied. 

Abst rat! ions *r P used to enpress certain key 'elahonships n a proai - arn - in ways which are 
m&re convenient (cm 1he prpgrimmtr, For instance, assembler larguages introduced,, among Olher 
things, Ihe idea o( using symbols as variables 10 indicatfl data fFOw. Compiled languages inlroduced, 
among el her Ihmgs, 1he idea of using synlaclic nesling to indicale data flow. They also mtroouted tne 
idea I hat aU ai the p rim i lives of a language cauld be modules-, freeing the language from any 
resemblance to, o,- erperde-.ce qa, any particular compter arehil&cture. 

Global operations tserformed by in assembler, compiler, Or inlerpreter) translate Ihese 
abstraclions inlo machine understandable fattrk. 7h»s trees 1he progr*mn^r iron> specifying details, 
such as actual memory adc r esse S, which, Ihpugh they musl eventually be determined in order for the 
LOmputatifln to be oarcrmed, *re nOl Of any direct mtcr&sl 10 1he user. 

The abstraction's facilitate verilicalion because t«ey ccrrespo-d more directly 10 1he properties 
reeded for vcniicalion. For e*ample a veriFicabon may require thai da! a frow occur front a use of 
module A to a use Of modUe B. Tne synlat! c nesling of (hp use o1 .module A in ihe argument list of 
the us.0 oF argurr*nt B succinctly eJipre55c^ ihi? requirement. Any added mechanism ot memory 
acscrfi-jsc^, slacks, parameler pscs-ing, Or variables y^-Puld just jet in the way. 

General purpose high level Janguages {suth as FOBTftA^ PL/[ h and ALGOLt have introduced a 
iarge number' of features ol general usetulrwss. They hive introduced abstractions, such as 
sufcji-outines and dala types, and modujCt such as access Functioni. tor cOmpfe* da!* lypes (like strings, 
arrays, and strucluresj. These lanjua^ss have greatly jimpliiied 1he programme process- while 
mainlaining general applicability by incorporating knowledge ol program wing techn.qucs. However, 
Ihpy have not gone far enough; programming is still ditticult. 

1.4. 1. 2 SPECIAL PLflPOSE SYSTEMS 

A number of systems have been, developed which ars more powerful than g*n*r*l purpose 
languajes due 10 the (act Dial they incorporate algorithmic information specilic 10 particular problem 
domains. The simplest ol Ihese SVslems are subroutine packages {such as the ]BM SSP [EBU 
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GH2B-BJ05-4]) which extend the power of a gene-a' purpoie language Ihroug-i 1he add-on of domain 
specific modules. 

To produce systems wMh scaler power, designer* have <ncor poraUrd domain specilfc 
knowledge in ways other 1han monies, for e*2Jtiple, consider 1he language DDL [Hammer, Now*. 
Krusk*! fl Wladawsky 1975] which can be used lu write business dala processes programs. BDL 
constrains programs Id have one particular top level alruetufe, This allows the system |o 
automalkal y aencrste ihe code needed 1o 1 m pie me rvt 1his structure. Father, air 1he modules and 
abstractions, uied m B.DL are specifically desirjneJ to 1i1 inlo 1his particular top level strudure in 
Order to make th*. user's desgn and verification Usks easier. All this makes wiling a program easier 
*s Jong as (he particular top leve st-udgre is. appropriate. 

This trend can conlir.up wilh system $ eonlaming niDre and more information abOul smaller and 
(miller domains, unlil tne Trend cumirjates in cuslOmizers. A customer c jri only produce a few 
program, but it knows all of 1he del ails o1 each of 1h*se programs. The only problem the user faces 
is discovering wne1h<?r the compulsion he desire* ca- be implemented by one oF tne programs the 
custormeer can produce, tf it can, the user specifies tne program he wants by filling out a 
queslionnaire, Verification it simple oecause the qj^sliOnnaire is directfy posed in the terms the user 
is interested in. 

»he problem with these syslems is thai they are too specific. A piogrammer can only use such 
a system H ;here happens 1o be one which applies to his problem domain. IF he change* domains, be 
will have- 1o .earn an erlireiy new system, Further, the more powerfuS One Of these systems is, the 
more limited its applicability, 

I A 1.3 USING GOOD PROGP.AUUING STYLE 

The particular style which a programmer uses h?s a great eHett On (he ease with wh^h he can 
write a program. Languages hpwg been developed which encourage soon programming style (for 
txample strLstturcd programming j, and make spme types el bad slyle impossible. For en ample, the 
language CLU jLiskov 1974] is ces^ried to make unstructured data access impossible. ]n'CUJ> a data 
item can Oniy be acceded Ihrough Ihe access fu-Kiions defined for its data type. Therefore, tt is 
impossible to <_se any ac hoc cafa mampulaliO".s which could LO-npUale tr-e vesication process. This 
approach extends the idea ol enhancing thl power oF a general purpose language by including 
proaram-mins «.ncv,-iedae in the system. 

1.4,1.4 AUTOMAT EC PROGRAMMING 

With arty of ihe general purpose languages discussed a,bOve, a programme/ faces 1h* (ssk of 
specifying whai modues are to be used, and how Ihey arc to be interconnected Automatic 
programming al tempts to automate this process, [n automatic programming, the user 1 * program is a 
Spccrdcation ol what is to be done, not ho* t is to be done. Systems have been denned using 
La*nfic3l.:on tirougn temples o f behavior (surh as I/O pars [SuTmcrs 1975; Shaw, Swartout, & 
Green 197£ t Hardy 1975] and traces [Bauer 1975]}, ujract spec ilical ions in a predicate caktilus like 
Language [Manna & WaJdinger 1975], Or English language detcnplions [Ruth 1976]. 

It is nol (rue lhal automatic pro e rpmmin & would eliminate all the eflort ol programming. 
Developing a precise description, of a desired *Onnputal«sn is difficult, whelher or not the descnpJiOn 
is aleonthmic. However, as 5 u medl y , a prDgrimmei' has always fiac to develop some descript«vo 
specification for a program ne wishes to write^ at least in his head. Therelore, writm 5 ar>d verifying; i 
prOgram H whicn is itself a specif icahon, should be easier, as lent BS the 1ype of descriptive- mechanism 
u!.:.-d by Ihe ajtomatK programminE ^yi!e-i i. .u",m-:.v sim^ai Ic :ii^ u-7 ij-^c-c nie-na !■-■ L-v the 
user, 

It Should be nOled that automate pfOftramrr.ing systems do not eliminate (he need for domain 
Specific algorithmic- knowledge. Rather they attempt to provide t uhilOrm. method of access to this 
knciwSedge. Domain specific knowledge muit be realized in She programs produced by an automatic 
programming system. Therefore, if the user is not gQcrirj to specify i1, i1 must be either known by the 
system beforehand,. Or reinvented by the system, in response- 10 a prOblBm. 
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UntOrluna-ely, it has nol yet been possible to cOdiFy Urge areas Of *r,ow ledge, ihoi^gh small 
areas have been codified (for evample, &«n jr-o FJarslOw Gisai s : -, f ho C idi holier, of kr-owlecge about 
sorting programs [Green £ &Vs1dw 1975]?. Fu^-s-r, the irobVn salving capably recuirea to 
understand specifications snd wrile a l&r & e variety pi programs based On a manjgeaoly small stock of 
knowledge ,s B lr.c beyond tho L hr- ol -he a.-t. As a ,-esuir, none OF 1he automate programming 
systems proposed has been made ; Q work well enough to be pI any pr ad ical use. Thos* which have 
been rmplemonled at til, CnJy work in a vei y small or simple domain such as simple 1is1 manipulation. 

The approaches described! afcOve have bee.-i djrtclcd lOvard develop^* an m1e 'prefer for 4 
language (whether algorithmic or Oased fin specifications J wh ch is so pp^erM thai a comply 
program can be Irivially written and venFied in the language. This is certainly a laudable 50a I, 
however, it does not seem likely lhat it will be achieved in Ihft rear luture. 

I A 1.5 AUTOMATIC VERIFICATION 

At tempi 5 have heer nade tc develop a syslem whkh wi|. a! least be able 10 verify lhat a 
program is correct. This would be particularly useful sirce true vesication has been mpgloded by 
programmers in the past. 

In order to make automata verification posssifcle, |he behavior 01 1hc prinulive elements of 
programming, languages had !0 Oe rigorously aromatized. Fur1h 9 r H pjool ruses had (0 be ceveloped 
so lhat the aiopms iabout Ihe prinuUs element* could be combined into a prool of claims about a 
program as a whole. This work was Slartad by FLoyd [Floyd 1967] and continued by Hoare. [Ho&r<J 
1969; Hoare 137]]. 

In order to prove eOme1hin& aOout a program (such as the correcinejs of its speculations), the 
kfly step is deciding what sublheorems to illicit, This is analogous to picking s-wbtasks in 1he process 
of wriling a program, anO unlodunataly does not appear lo be any easier. In addition, Current 
Iheorem probers are no] able to prove theorems of any £re»t di1ficu:ty. 

SErii E hi forward selediOn Ol subtheorems is orwy possible in slraight lir* programs. If (here is 
looping involved [wja gotos, looping constructs, or recursion), Ihen heuristics must be used in Order to 
nr-.-cbo subtheorerns wh ch descnoe Ihe action or the loops \iat e^ampSe [Wegbreil 1973]). Systems, 
*UCh as that of Boyer and Moore [fepyer ft Moorfr L975; Ivoore 1974], which attempt to prove 
theorams ahout a program by looking just at the program, are onfy able to work *ilh siinple 
prO£rarns, 

Systems, sucn as Iha1 OF WaSdinger and Levitt [Wald^ger * Levill 1974], where the user 
specJIies loop ass er I ions, st:IJ cog down on reltfiv«lv simple proerims cue to the weakness of currenl 
theOfem pro vers, artd the problem o« cOdifyina WHi using enough domain spec i1 it itnow ledge, 

IAL6 programming assistant systems 

There are several main ,(Jeas behind assistant systems. One is a recognition ot tho tad (hat, in 
the absence of aulOnatic programming, progf b«s art n^t wrMten in on* pass, They are wrillon bit by 
bit. and Ihen moSiiiad and added 10 many time* it t^crs are Jound" and corrected, and the Original 
specification lor tha program thangas, This iaei kads to a desire for systems which combine editors, 
compilers, interpreters, and debugging aids inlo one inleraclina unit. This combination would Faclilate 
cycling between *r,D&e 5 ard the wtedion ol errors. 

A secorrd ideF is to have 1ha assJslanE sysl^m keep track o1 a myriad of details, and help the 
programmer avo^d pit^lls. This is a natural extension pi [he idea of designing a languaee so as 10 
ercouraa* $00d programming style. An a»i$Un1 system wcmld utilize Knowledge oi prOgrarnmina in 
general, and of r-,c paMicgJir linkage which the programmer was wsing in Order tc ealch nwny small 
errors which might Otherwise lead 10 big proolems. Whal ma*es this cpualitalively different irOm 1he 
many checks done by current compilers is thai Ihe bookkeeping would e K jit across 1he enlire process 
oF develop. n a s program, np| just within a single compilation of a single sub unit. 

Sy 1 hen-selves, these two ideas are nol very editing.. Tney should he wselull bul not 
s-peeUcular extensions Ol current programming sy^em?. In order to really assist a- p^oaramnier, a 
system must enter inlo the programming process, either in design or verificalion. The main tenent of 
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described .bCve, &^|^(i'L*™5; f V * nd '* ?"*»«« <* •utomalic lyih^ As 

.«d b^ m ^^ rt ^^ a aS4i4ti ;' ^ ™ P"» *>™«| by Ftoyd [Floyd J 971] 

raized. LWino B r a d 19731 ht«»Ef they d.d not & u SB «1 haw S(Jch a system cfluld be 

1A1.7 PRCCHAM UPOER5TAJYDEWG 

undftrsfondhii kte h. ^V 1 ? ? Programmer has ddrw and it doing. How \h fS 

de £iS n o ?K B ^ ffl P "ielMh P ipi V"' '"I""' 'J' '«*™. ^ ^nf.c.Lon, ,nd the 

If I i^terr ^MrtT" spee l, " hDn ^ «*• Pnur^ the VOrificitton,«"d (he d* S , E n can be d<-ivec 
virificatidn. J *P«<f,-«I,onB arai the pra S r aini ihe* it could do autqr^k 

Wrfintin and W ril inE CJ 1he r^"™ * P " n * E " ^ eVC ' V9d ^ * ■**«»,. >»d »i«l in 

by . P C^ e pl a - s L: £ET ]1 al " mu ' stiSit * 5 *"" *- c " bB ™ 1ed - d -^- 

5-4.2 SIMILAR APPROACHES 

r~3S> : SS5£?? ----«» 
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WrCROFT accepts at mpul 3 program whkh may hive bugs, and a parish description of the- 
intended output. ]t then proceed} to conslruct a plan for the program. The user can oplionally 
include commentary ^t, ihe program jndicaling fealurs? fli t^e plan. 

Out To the speciri-c nalure of the domain, the 1«k of iinding. Ihe plan consists largely of 
deciding, which parti of the actuaJ «u1pu-l cce respond to which parls 01 the desired Oulpul. MYCROFT 
altempls to find a plan which minimis the number ol errors detected. How easy this is to do 
depends or, how we'l the natural segmental ion of 1he program corresponds 10 1he descripfion ol thi 
intended output. TJni* segmentation is a very importanl lorm Of commentary supplied by 1he user. 

MYCFQFT uses 1he plan to propose fines dor the bugs il deteds. [1 then proceeds to construct 
a currCTlcd program. ]f is mosl successful when a bu& is Caused by an incorrect value (such as a Jine 
sejrr.enl be ng too long). It has mere diff,culty when « bug is Caused by incorrect log'tal structure of 
tne prosr-*m (such as pieces of the intended oulpul cpmpirftelv leil Out}. t! seems reasonable that 
programming assislanl systems in general will Follow 1his pattern. This is because designing (he basic 
logical structure o( a program seems 1p Oe a mere dilficult 1ask than picking lh c correct values to use. 

t.4.2.3 RUTH 

Ruth [Ru1h 197£] developed a language whLCh can be used 1o espres* the ?et 0* ill algorithms, 
for j, given task. This allows him 1o encode th* domain specific algorithmic information for a particular 
problem area. His system takes as input a program »nd 1h 5 description of a set of algorithms, Jt then 
determir.es whether or not the program implements one of the algOrilhms,. If a match is found, the 
corresponding algorithm is reported- If 3 match is no* found, the system Iries to find a near miss 
algOrtthm and reports diJFerences from this as bLgs. His, system has successfully Operated On real 
prOgraTiS wri1"er- by sludenls learning; programming. 

His system performs a compose palter ma^chi-rg 1ask. ]t operates erectly On Ihe programs, 
which a-'E wrilten in a simple algeOraic USP li*e language having a condihonar construct and a looping 
construct. Comments on (hB program are nol use<f, except for the implicit commenj thai the program 
is intended 10 implement one Of Ihe specified algorithm*. His system does a Jot of wor!* in orcc ta 
ce^l with Transformations which can b* applied 10 programs. [| does this m Order to detect when two 
programs are essenlially the same avert thOufch they appear, a1 firsl glance, 10 be very different. 
Transformations are also Of considerable imparl ante m 1he domain of FC3TRAN propr sms-. His system 
incorporates knowledge about common bugs so thai near masse; c*r. be detected easier. 

Ruth, does no! deal with plans as suCH He identifies understaneSmg *jth determining which 
algorithm corresponds 10 the given program. The algorithmic representation he uses cap1ur.es scrne 
of tne nolions of a plan. However, H is more like a lypiCJl implementation of 1he algpnlhrn, and docs 
not COnlam IsleOlogkal information about purposes. 

1.1.2.4 BRCWN 

Srown's system WATSON [Brown l$75| BrOwn lorthcDmlnjf also; Sussman 1973b;. Brown 
l97fl; Sussman & Brown 1974], localizes failure! >n electronic c^rcuils. As input. It ta*cs- a piece Of 
electronic equipment (which it operates, on by giving tgmrnands to a person who makes test $ and 
adjust ments), its circuM diagram, a plan lor the circjit,, and a deKriplion Of the problem, it is exhibiting. 
The plan and circuit are assumed to be bug free. He laJlure is therefore assumed to be due to a 
damaged component, or improper adjuttm B nt (note the similarity with Eh* bugs which were easiest loi" 
Goldstein's WYCHOFT lo handled 

WATSON uses a variety of techniques Iriggered by features OF the plan in order to localiiJ the 
failure, The plant ^r^ cCmslrucSed by hand and input to the sysJem. As a result- WATSON does not 
AtUck Ihe problem of developing an understanding of i CircuM. However, his system shows the 
Lmporltartce, and power, of knowing plans in the domain of electronic circuils. 
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1.4.2.5 GEflHlART 

h™ ai i f° rrespond to Sim .Ple P'»' rtries. Thi E is in line *ith the bam *ork of Ftovd and 

^^ir::;r^:^r r>m -•* Th - — - - ^^~z 

tht s £ 2i I h^ J ^k y -utOiMLcHly wtjlil, i hM . *r work is Atoned here b*« wc Of 
he «n»taf .ty be1»„* hf, prear , m 5ihemtU , nd 1he |an Further the 

with a pL,n for the progf^, EMn tti , ugh ^ K M f ^ |jci| fc^^ infflrfpa ^ n _ 

[-4.2.6 HEWJTT and SMITH 

197* Su r d sSJ! h i™ ■™ n,n,,n5 aDpr * n!i " ^'^ w * te » * Lie«r™n 1973, Smith ft Hewill 
He iitVs ACTOP^ r lS75I T * " P' *™"* »H*l«1 system ow^ed to w0 rh in !h fr domain of 

In can? r ', Tn ■ ^ "'*" ** * f """ *^ te ™ * >"*!•* *■ ™rr W tn e5 s of programs. 

™T .J -/^f'". 1, Con1r « ls "rr CS pond ra W h4l ir-e called bth^^l description* in this 

h* v y ^Out^ T'^V'^ " * Suhr * utw - '"* *"<** ^--'- -c -^ 

sssrc^.."ss^r^ ha? a cortTract fl - 5ciated * ith iu this ■— * : 

■ArT™ °H d T V"** c0r ' ectn *«' H n*lMMluBliqn* {which it simitar to s^balie .^luaiion) a nd 
ACTOR ,nduct,Qrt are „„ d . E* t h lutein, i E pro^d Id uM t fy its caiiUxt v,hic^ is «rt "J 
le.nma urhtn pro^g tr* wrrectn^j of other subriutinet. 

s^pjiB^bv lh-!.7*? ,? K LSr W, J- P ^ ^"^ ™ SlTyt1Urfl in * ddltl ° n ^ tha C0de * rtd **""»«* 
D««n I imoliVir. -« '^ r ^^'^ t*rre S pon„n e 1o a pl.n , E fronted, »nd m o,t of 4 .s an! y 

hL.l J .'. * P ] '* USed t0 "^^ d&,Min s ^ Hi ^ informal ion and 1^ outd* 1Kb 

theorem D ra./er w,-,ch ^r* s will, Ire nela-ewalualor. B 

■triieW Sir!*" r " )1 deBl WMh BU ' WU * k B9Wf * ti0fl of dt«ripti*i rinietmi, Any pUn-Jika 

■dea e , behave ra , dweriphon* C"«rUra (t n. Thei, . rk » b„n E attended hy Y & n, S awa ^ 
1976], Hgwevw, meta-evsl^ahon it still larseljr at the h,nd 6im v l,tiCn s] aa e. 

L4.?,7 GREEN 5 nd BARSTOW 

■ Hrt - H *"!!. th V a ,*■ ^, la r nfo, '* i "ni^sily ha^ b .en doin 6 t ons,Ser,b| e ^o rK on wh.t Ihev call 
proar^n. urterrt.nd.ns- [Dr«n tt al. I974J taw*™, from the point Ol viL oUnis ™ Eh" 

Th^i ^ ,r * C , hn ° Wi ^ U ' S,,nple wrt P r8 »« ^r 8 en 4 S^r.tow 1975], 
*«t* m ™M,f r h T ^ *" WOU ' d * n ' y *•***!*• b * -"^'"B h.gh level design deUiOns Thg 

^irXAn^tntZr hnfl * ta *\?' hDW +Q «^"^ write iriing pro,™ J Cr pape 
SS* wi IH h t In ' 0rn,al /"» rt "» whl = p the syslrn- -,-cuk: ) |, DW , „nd on Ul hno W l«l4 She 
S y S Tem *ould h^ve TO h^e. It dee, „ C | di«u„, -n »y dt1»l p ho. the sy.tr. could b* ifjSSJS. 
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M.2,8 S[CH *nd SHROBE 

distant .y,| m rf™Id T ™ ih* *' *"* """^ C '°"' ,0 ,h * Kind 9l *">««"& 

» «• nrZb J^ Iri ll W m ^ "? P ' 3nS ^ * wlopflJ lhr °^ * "*'* w»h the u« 
in ■ JLar ^nw^^SS^pT * * "" " '" ^ ^'"^ ^ p ™«* 

1AZ.9 IBM 

Jr^ms w.itler, in lhe Jfl n,ua Ee BDL h^lt K C £■ SJ "l^X S£f? 
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11. TME TASKS THE SYSTEM CAN PERFORM 

ranr-l',^!!!^ d ° ^V ' hi * is ' FifSt ' i6 " n ^ D P art understanding of * maLhemitittl 

■ Nn^JrJ^'l^l 1 '^' und ^ andin S i5 Erectly <M.p*d thiough the utumphon toll Ihe *V*t.m m US | 

zsk* r^r^c™:^™ "*" s « <■*---- 

»n > n ?!,«h!!'! a " 1ir ** 1he 6 ** rd f '* k b * W'j»n B in WM the types of q w& tiDn a *h* System 

[I .r. mL?! I^ ™ brat,hne RKi '^ m "* IBW SSP- A" ■* the e **m P |* 5 in »elk* 
li art [afcen Br£rfl this program, 

1 C PURPOSE 

| C INTEGRATES A FER&T ORDER D [ FFErW J AL EQUATION 

3 C DY\DX-HA(X.n UP 70 A &FECIFJED FINAL VALIE 

4 C DESCRIPTION OF PARAriETERS 

5 J FUN -USEP-SJPfLtEO FUNCTION SUBPROGRAM U1TH 

% c arduhents x,y which gives qv\dx 

7 C H] -THE STEP S12E 

S c *: -i:.: :.-. value cf k 

J C VI -IMrTlM. VALUE DF ¥ WHE V[-F^t) 

- d C XF -FINAL VALUE OF K 

11 C '-> -"U.4L Vnl . " ■;- -■ 

12 C AN3H-HE5ULTANT VALUE DF X 

13 C A«SY-RESULTANT VALUE OF V 

J* J EtTt€R AMSK-XF 03 AHSV-yF OEPEWliiG 

■■■' c ON WHICH JS REACHED FIRST 

T = C lEfl -ERROR CODE 

17 C jEfl-e m £R??o?| 

|f C 3ER-1 STEF 3;ZE IS ZrP3 

19 REMARKS 

?? S j| 2! ! & ^^ ™ 0R EflUAL TD &• AN SK-XI AJ© ANSY-Y] 

22 C lETHCD *WK*XI, WD ANSY-fl.e 

7 J J ^ES FOURTH DflDER RUNGE-KUTTA IWTESRAT10N 

ZJ C PROCESS ON A RECURSIVE BASIS, PRUCESS ]5 

" L TERMINATED AND FINAL VALUE ADJUSTED WHEN 

26 C EtIHER XF QF YF IS REACHED 

27 C 

28 SUBROUTINE HKHFUN^HI^l^I.XF.YF.ANSK.ANSVJEW 
- L I [S LKS ™ N m EDjUAL T0 ^^ ^™^ WI P VI) 

31 EF (XF-X] » 11,11,12 

32 11 ANSX-XI 
-•■ ANE-V-YI 
3* RETURN 

35 C T£ST INTERVAL VALUE 

36 12 H-HI 



r 7 if £h» ig.h.^ 

3S 14 IER=1 

33 AWSX-XI 

41 RETURN 

« 1G H-m 

*3 C SET KN-IMTIAL *. UUNITIAL ¥ 

45 VN-YI 

*5 C INTEGRATE ONE TlriE STEP 

*9 caro i7fl 

'-Z 25 XNl-MK 

^1 YNl -YY 

53 C SmSiJS B?S1" T ° " FCN " L AM1 6RANCM flCCDRDiNGLY 

~ C ™ XhJ1 - M ^ RtTUHM*(HF,¥Nl) A& ENSUES 

3 30 ANSX-XF 

SG AHSY-VNJ, 

57 care lee 

5- C ?ScS!2 E E ll I , "!' B I ™ L SET NEU ST£P SIZE AND 

63 40 kJeuSfIn RE ™™ RKLLTS AS AN5UEH 

Gl JUnP-2 

62 GOTO 1 70 

S3 IS AM3X-KX 

GG caru lEfl 

S C ™ * N1 LRS THAN X Flmi - r CHECK EF l¥N P *NL) SPAN v FINAL 

I 60 SI N} ^^ "^ SPftN Wt ^ «",W-tXMl p Ymi P REPEAT 

70 MN»XNi 

71 GD70 170 

"<; 80 ANSV-YN 

75 AWSK-HN 

7G COTD 1S0 

77 100 ANSY.YIVl 

?S AN5H*XN1 

73 CD70 160 

81 C 110 DQ N U0 Jl |Xff VF ' TRV T ° ^ * VALU£ ASS0C|AT ^ UITH YF 

&3 C n^S^STJS^ TtnE ST£P AND INT EWAT£ DNE STEP 

fid c TRY TEN [NTERPTXATJCN5 AT HOST 

84 Hh.SU, i(YF-VN^[VNl-yN]j*(KNl -HO 

85 JUPIP-3 
SG GOTtT 170 
&7 • US JCfcJBMffl 
SB YNEU-VY 

S3 C COMPARE CGfiPdT£D Y VALUE UtTH VF AKTJ BRANCH 

90 IF (YNEW-VFI 120,156,130 



SI C ADVANCE, YF [3 BETWEEN YNEI4 AND YTJJ 

32 120 VW-VNEU 

34 GOTO 140 

35 C AOVAHCE, YF [S BETWEEN YH AND YNEU 
96 130 VN1-YNEU 

9 7 kn: -knew 

S3 145 CONTINUE 

99 C RETURN [XMEU.VF] AS ASI3UER 

105 1$0 flNS^XNEu 

101 AN&V^Yf 

: P2 1E& RETURN 

103 C 

10* 170 HZ-kNEU/2,.0 

105 T 1 -HNEU*KJN ( m< YN ) 

10S T2-HNEU*P|JN fW+K^. rN+T:/2 + 0) 

1 87 T3-HNEU*?UW 1 KN+H2 , YK+I2/2. &J 

1 05 T4 -Hf€U*FliN ( M+HNEU, YN+T3 ) 

1 09 VY-YN-. ( Tl +2 , B*T242 , 0*73+74 J /g . 8 

110 XX-XN+HNEU 

111 GO'O f2& 1 45,115}.JUflP 

112 F'.j 

IL1 ANSWERING QUESTIONS ABOUT A PROGRAU 

0* th^trtlTJZ*"^' ? i 7 ^^ ™ ples ' S * V5ral d «» fi al ««""• which co^er rat 

Mi h f 7™^'**-°' Whi l * USef ™ fih ' " k ,i,1,lk * ) * boul IJ * ""i™ *KI> **d of what th, system 

A h n ( , ? '* gi6d m 5h * p,rtp °"' l5r da/ ^ ° f «po, .lion. 

Another poinl whjch should be riJ se d h jj rh ,i 1he quBs1i 




inc- port. 
In ihe es^mples, 0nfy reasonable stents are mentioned If > user ^k^ri .h„„ f , 

e^sSSesi 11 " t, ""■ MI * ih * »■ — ■■- ™» « ».-^^^ 1 ,^ 

mm a belter idc? «i ihe „ B nwn1.tn,n so that he ccyld ask £ eelter quMlton. * 

H LI REQUESTS FQR DESCRIPTION, "WHAT" 

Tta most bail? kind of queslio.-v which can b* asked .*. ^Wipf it thig^ The aues'ian doe* nal 
aeicrip[ ( on or its behavior. Consider son* snamplfr*. 

UWnat 1j 7ine 50 or" £J?e flj-ograffl fl-JSJ? 

Jitta m^rTi-'^"!! 1 ^^ P9rt D ' ' dili "** Pa1h t0 «™iini«1 B 3 
to the outside of RKJ via the Unable JER. 
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2) What is line 31? 

U is a-> AHlTh^ETX |F si ate ma nt forcing paft of 1hc control flew connective 

I issue. 

3) Wild t 1x "XF-XN" in line 60? 

It it a use- of the pfimirive Function nunus which computes a-b-c. 

Questions $uch as- the above *rp nOl very interesting. This is became it is obvious- (0 us, what 
such small p-iKts of the ccce do, It should be naiad, however, th«| it is important that th<? answers 
to 1hese questions are also ohvious to Ihe system. Even it no user ever »s*S &ueh ques-t ions, the 
system will ask Hself such qu.es1ia.ns when it is trying to answer more dilficutt questions. 

"What*' questions bccOmg rnore inte^esling when lhry nrc fls^d about .arger sections of the 
code or from j ripr-local pDin* ol virw, 

4>kfhat does tnis Segment [lines' }Q4-UQ} do? 
It performs one slep Ot migration. 

5} In more data?!, p7ease. 

Starling with XN, YN, HNEW, and FUN II commutes XX-Xr**HNEW and YY-F(XX} 
^iv-en ilhal FLJW£X I F(J( tf-tfF/dufXk and YN-F()eNjL 

Note that, <n this answer H (he system used (He variable names in the prajtahn &$ names (Cr the 
data items it was talking ,ibou-t. Internally is does not name tiwm ( hat way. It realizes that the 
variables H* Only part ol the dala 'to* connective lissue, ar.d are not satisladory as names- for the 
cala it^mi. bpca-jse one variable pi ten tifr us logisnlrv unrelated data iF*ms in dhfersnl parts oF the 
program. This notwithstanding, il is probably OoF^e* 10 use the variable name* when lalking to tha 
user than ad J1QC new naires lor the- dala items, 

6) What 0Q£& this sequent (lints; G&-64) do? 

[1 computes ANSK-XF and MIEY-F<AN£X} sterling with XN, YN, and FUN & ivcn 
that FUN(X,Fff»-dF/dx(X)v Mri YN-F(XN). 

7) From fftfi point of iriew ftf that Moment (lines: £0-rj4j what 
tfoej "XF-XN" in line 69 do? 

II computes HTEW such thai KN*r*£tt-XF. 

'What" queslions are answered through relent* to 1ha inlrinsie and extrinsic behavioral 
descriptions of segmanH (behavioral descriptions are discusted Fully in seclion IH.2.1J. The 
diflerence between intrinsic and extrinsic behavioral descriptions, is illustrated by the difference, 
between The answers to quesliO^s 3 and 7. 

When ashed about Jarje Sos m cr*i;s, the answers to "what" quetl ions- are nOl obvious. The 
answers to queslions like 4-7 could aid a user m yn^jrster,di:"g trie program RiCl. SMI, the answers 
to these queslions do not explain the prOe/am, they only destrrbe i1. 

114.2 REQUESTS FOP EXPLANATION, "HOW 

"How" Questions *$k 1or an explanation d! th* internal workings of a pie«e ol a program. For 
CK am pie, "Haw does tnis wor*.?" A related set of questions isks J>ew a piece of a prajram im crafts 
with larger pieces containing i(. Fvi* ?Kample, "When is this eiecule-d?" arid *Where do its inputs 
come Iron-?" TF^sc q JC -st ors are realiy just asking few an enplanalicm at an aspect ol the wordings of 
the containing &egmen1. C&nsadfr some examples. 
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S) Woiv Joes True JU wcrk? 

Assortment is * primitive operation w h:rh cppiea a value (here 0) to a variably 
there (EPJ. It (arms a |,nk m a data flow path. 

S) Wtail fj Jtfta 30 executed? 

It ie executed pn« every time RK] B e^culed. hnw^tt, logically it should 
&nly be executed when XISJCF w tfrfBL The line w»$ 'adored Ep iis current 
PDi.l.On from, that segment (lines: 32-33) and 1hai segment {lines- 
3b-3,,fl2^31i. Wh«n XL*XF ft H]-3 I he ejects of line 30 are overridden by 
line 3S. 

Nute th»t the system volunteered information aboyt |h» factoring of Imr, 39 It did thus betause 
, Lndcrsla^fls thai In* «.mp e stare™: "Line ^ -. r,-u- : J *-. lc eacn li-r« *>: is." £ .,,, .... :J r , 

10J W<?w dmt Jine 3J work? 

It Lifi K5 [he FORTRAN control f|o W canstrud ARITHMETIC IF to convert the 
segment "XF-K: - mfo a predial* determining whelher Xf<XF or not. 

HIHtMt does tfrfj segment /lines: 50-54) work? 

ThB basic segTenl (lines: 66-62} is * cOmposilion pi \ im 60 (which determines. 
HNtW so that KF^IWfCW and thai sr^menl (tines: 104-110) {^hith parlor jn* 
a *t»p Ol integral ion yielding ra-XN+HtiEW-XF and YY=F(JCN». Lines; (61,62.1 11) 

fo! 1 C M^ Di fl<j * c0nfwchv '* 1i " ua implementing the link to rhil ago-merri (lints; 
13*1-110), Line* (63,64] are data (irjw connective tissue passing the results 
along. 

I2)ytien is this sesmeni (lifttSf 60-64} used? 

When that Joop (lines: 44-53, 67-71) terminates w»EF> XlJl>KF, i> s segment 
{lines: 66-64) ■ ji used 1o compute |h« results of the prc-gram RK1. 

These questions are sneered through reference to pfans (see section IU2.Z). The answers 
oescnbe how se^cnls interact to 10rm ]***, se^e-ls. The next two scions describe queslians- 
which gel at specify aspects of thr E interaction, 

11-1,3 REQUESTS FOR PURPOSE *WH¥" 

A question fit thJs type asks fqr !ha purpose pi ■ construct. ]t ashs why it is in the proa.ra.rft. 

13) What is the pu-rpvse of Jfft in line 3$? 

The purpose ol this use Of !he variable [ER 1$ fo form part 0* a data How path 
carrying (h* value io the oulside of flKl. 

14} Wftjf f 4 £n-e purple nf £JiU da£a . n<jw p ^ tff f fcfrfi oJj- 
Mip Tent* ted by Tine 30 J? [n the situations where xi>XF v HL-tf, this path 
carries one of Ihe Outputs (0) 01 the program, as required by lire* {17 p IS, £0, 
21) It is ir^idental {not pjirl of ils purpOseK that i| abo starts to tarry when 
XhKF f\ Hl-0. Trie value \% owerridden in tins case. 

lolWfty Is 71 ne 31 it) th& program? 

ThiE p-edicitc determines whelher Xl<& or not. This is aone so thai the 
cpn-pjtalions requBsted of 3h* program RK] tan be divided into ivo classes One 
wnere K^XF ard one «-'here X]£XF, 
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«) Wriy is tJiSs jegmnt (fines i M . MJ ffl t ^ flMar ^ 

ihp purpose ol lh* se£nen l 1S lo «n, P ute a^S*. ^ ANSYi , Wfl oi 1hfi fesu „ fi 
or the prp*,^ Bk , , . n 1h* B Italian wh*t* trt&E Jdop (lines: 4 J -53 67-71) 
terminates wi I h KM; >XF. 

EH* ^ll i^il^'iS*?" "V n ™ t0 ,hit ^«'*n ind Ihe answer to question 12, The 

!. 'XT^JTJXVh" ^*'^»^*« >-«* .Merged. «^ W 

1?) Wrrit fj tfte our-pose pf ? f fle j7? 

Due to Ihe (»1 that t* ver al test* have b „n combined into this or* consist, Ft 
ser^s Ihree aist.net purposes. Firs}, if determines whether H]-0 „ nD 1 Thts is 
Lreea 10 divide Ihe corcpulat an; -quested at the program fltfl into two Masses 
Second fl nd ti.,d, * lhai 5e& m C n1 ( : jn e * : 36, 37 , 42), 1 hi s line (37> impl*n,*nl s 
two preetititea. One check* whether Hl<0 and the olher tha-^s whether Hl>0 
Inesc a^e uac -d Id divide 1he problems Iwcd by 1h»r sag-rent (lines: 3E 3? «)■ 
whJth rtmpytfrE the j&wlute value oi HE, into two clmes,. 

Htf* ft Fs seen thai One piece of code rnay have several distinct purposes. 
IS 1 , Why -,& ij ne so Jn the prograa -i 

It If composed with thai segmer,!! (lines: Ifla-ljff). Ila oylput WW is 
computed bo th*t when HNEW is in pu : to that segment (l.nes- 184-1 10) [ ha t 
segment will produce an output XK-XF, 

These rations are answered throuah reference to purpose links in plans (see action W.2.ZK 
IL1.4 fiEQUESTS FOR JUSTIFICATION, "WHY' 

These question art far the reassn -^y sc ^ In, r. s is tf „, Citen »™ih,n E is In.- b«*JM i! 
;s some segment s purpose to *** it irui. In <hi S case, a luslHicatian qaeshon , s just a pu^os 

sssid t^ssj; :;ke miy be -^ to juitLFy wmethine *™ ih °^ ^ ^* • »» 

II is talisded he CiU5 e the saw requirement is a prerequisite ot 1he immediately 
40n lammg ,*g ran t (h nasr 6ff-64) and its satisfaction carries over. 

2Q)Uiiy U this prerequisite fof Unss: 60-69} satisfied? 

its satsf.-, c :ion is £ uara-leec bv a chJlin q1 srer-equisiles retehina hack to Ihe 
j>r V requisite* Ot RK1. The value Of XF is e*r,J B d unchangad from an argument to 
the program RKJ which it recuir-ed lo be a lloaling nuni^r. 



Seeing th»t the u= er it in!er CS ted in > fylj justi fiction for ih c prereqyiiite, th= system lr««^ 
•bOv e . if RK. K ca | Jed with lhe , reufflent XF ^ hich is w1 fl f|aa1jrtg ^^ i( J*;™™ ,Kan lh ' 

104- UQ) in this stBBtnt {lines: ee-G4), Why is ttie 
trtrewlltte that W,4fU fte * flo.it frto jivjnber satisfied* 

ik> S^.i*'' b ! CaU ** 9n ° USp,j1 « S9flion of Ji ™ ^ JV source of HfsEW, states 
ihat HNEW is a floating, number. 
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"IKS SS^SyjiSr — «*" * «*'« »— <»■«.■ 

Data (l 0w {„„«. W _ 64 , m ^ es AKEX-X* and ANS/-VY, St i» a* Qut& uF 

"•SB SH^SUSr ° uttut — •«- * «■* -~* n«-« 

sotrce of h\EW, tut *.V.h.\ElWF. Ttorefsr., ANSX.XF. 
roquir.d, wte* Ita j™ „ fe'djU. 5' ! S , """ 0n """» l "' If ' ™ rB ""sle. prod i. 

Trie prer«.qui£i(* B of this segment (lines; lflfl-lia> 0lli-.aU. +h » 

the ml^?™'^ toS N S i ™ t ! aW ? ^ * qui,iDns ""* White 'he Iritgr.l Cvcr 

inteiral. though (hit would h! i MnM k ? ' U * tf " 1 the Bqua,l0llE «lu#lly calculi the 

«wiob geinng irwalbttf in th* fnathemalicBl camp eJ il, e5 oi approximation 

These quM h fl r. s are ^wered lhr D u S h r.fc r8n « 1 ,e«a^ link* In p la« [ 3ea se , Ji&n m & Z y 

U-J AiDlNG THE aE9UGG[NG PROCESS 

me b^Mr r.d prog/unrner *ver inlenci! to divide by lercJ c ' mai m 

The r ffSU lt of Jh„ jocose i* a sin£ | e wliijr, tl* B r»d pl.n. It a p^i FieS whal the Sys te m thlnte 
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trie operation inl ended by Ihe programmer ►!, and exactly how rh c program implements this operalion. 
The system cilMOl represen1 bqrh the- Operation oF (h* program and Ihe intended Operation of 
the program wi]h One dsi.c-iption if if |.-jnks there are any drlferences belween Ibem Any 
differences it ever finds are reported a; bugs, 

ILL! FINDING 0UG5 STATICALLY 

rhe syslem gj.fei the programmer's annotat.On is a guide for developing a detcriplion Of Ihe 
Operation ol a prolan,, Afler th* ,s accomplished, the annual ioi\ Jinci -eneral knowledge noOuf what 
moce-s ol qptralidn are- reasonable, are checked .i£aiivst the operalion or the program. The syslsm 
tries 10 juslify thai 1he 1 mentions of the programmer are realized in ihe progf am, 

Looking at a particular <lainu 5he system -na> p-ove thai .t is valid. In that case, fire. On many 
Oceas-Ons, Ihe system wilt rwl be able to com* to any candutiOn about the validly of a claim. En thai 
C«#. thB system just belies Ihe claim it true, whle remembering. I hat it if ur*Subst:anlialed. 

Alternately, Ihe sjyittm may be able to prove that the claim is invalid- ]n that casE, the system 
report? 1his as a bug. These bugs, which are fOn,nd viH p**-e*ecu1iOn analysis of the prOpiram, are 
the subject of Ihis section. 

Tfiere arc several eenrjrat claims *hi*h can be assume d 10 be intention* ol the programmer {at 
least with regard (0 simple malhemalJcal FORTRAN programs). These claims can be used 10 uncover 
many bu&S. 

One claim j& thai the extrinsic prerequisiles d« every se&me-nl must be satisfied. This is to say 
tluT no programmer will deSiberalaly use » Ee 5 ment with inputs Outside it* slaled domain of 
applicability. Testir 3 this cla m a 1 Ihe beginning ol every use of every segment leads to the detection 
of buas s-uch es mtorr.palible subroutine argument, using Ihe wrong variable name, leaving out special 
case checks, etc. 

Another general claim i* lhat 1he satisfaction OF Ihe extrinsic prerequisite* for Ihe una of a 
segment must imply ihe satisfaction ol Ihe intrinsic prerequisites of the segment, [n a similar vein, 
the imnnjc assertions or a segment mutt imply Ihe entrinsnc assertions of 1ha1 segment. Thai is to' 
say. Ihe sesmenl must be capable 0* what ii has been asked to do. These claims uncover hugs based 
on a misunderstsmdirg 0! Ihe inherent abilities of a segment, 

In addition, there ere o:her rr-o-c spec J i: claims Claims such j 3 loops must terminate" 
uninitialized variables cannol be read or rttur-Ted, elc. Many of these can be handled by properly 
statinj fhe prerequisites 0' Ihe primitive construct?. 

The really investing bug detection involves totnflaring what (he programmer said should 
happen with what does happen. Consider ihe example pro-am, RK1. Inasmuch as it is a published 
?-z;..iT II;" dc-j:-!= Muv :t — _; ::t f C - y f ;'^, ; hi! no h . .;-, n : w.Ch :..,t cac Ic c .it i- 1rO->-i- 
failure ol the program. However, it does no! operate in Ihe manner thai Ihe comments clearly indicate 
that i1 shouic. 

For example, jn examination of the progran realty shows that th<? comment in linn'. (2&-21} 
does not correspond wilh Ihe ooeralicm of the program. The cOmmenl &&*rly slates that JSfiXF -» 
ANSV=Yt and ?hat H[=0 -* ANSY-fl.0. The way 1he irog'im Opevales is that XJ*XF - ANSX-YI and that 
ANSV=3.9 en y if H]=,l t. jcl<XF. ]t ^an b* seen lhat this is a bug in the comrrent, not in the program. 
The mode of Operation indicaled by Ihe eomrrent is impossible smce Xt^F and tfl-8 are not mutually 
exclusive conditions. It is jJ 5 o dear tnat this is a mirvpr bug, as Long as some other programmer doe* 
not take the commenl seriously and wrte another prggr^m which depe-nds On 1he fact thai Hl-fl ^ 
AN5Y«*0,n, 

A mora serious bug is invoked with the search scheme embodied in Unas (&l-9S^ Thi>s 
SEBinfrrtt uses repeated interp*la lions to seek out WJEW such thai ffKNEW^YF. It is basic alty just a 
tlighNy improved vsrsiofi ol » halving search fln wnich Eine E4 woglrj be HNEW-CXPU -XMJ/2 ]. The fcey 
to the melhod is thai Ihe mlerval {Nt^l) always conlains a root of F()0-YF and that J he size Ol 1he 
interval decreases at each slep. The sirnple ha^virg search is guaranleec to improve the accuracy Of 
the result by a factor of 1@2J in 1Q iterations. 

The search starts with YF in the interval {YN.YWl) (note the commenl iine S^> r A new value of Y 
is talculafed (YIMEW) and ihen the Ies1 in line 93 :s usud lo cale-r: ne w.-c:her YF Is in the interval 
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tYN.YNEW} or Ihe interval (Yr^EW/rtgi}. This inlenlion ii inhaled hy the CQmmenls in tines r,3S,91,95). 
The problem is that the par1itul*r predicate chosen to snake 1he determination will work corractfy 
Only when YP^YNL. M YIV^YNL, i1 consistently makes the *«n E choice. As a result (he search will 
only work in the inlertded fashion when YJWN1. Ih»s t hawever, if not assured 

The form nf the test in line 67, which performs a similar function, indicates thai the prog rammer 
did not^ inland 1o limit RKi 10 waring on mOnOlonicalfy increasing lunctinns onty. Therefore it is- 
probably tne 1es1 •?■ lire 93 which is in er*0r, and should be changed 

Wilh this hug, 1hg interval (KtWl) if no longer guaranteed lo decrease In vt* r Of lo even 
contain a ron| pF F0Q-YF This, would lead to eons derable trouble if ii were not for the fact thai the 
search segment 15 robust. Firsl a line S4 can evlrapoiale as well be interpolate. Second, Ihe segment 
implemented by lines <l8fl-il&} will work fine with HKEW<0. Third, She segment implemenled by hnes 
{90-&7> tends to create an interval fYHYNi) conlaininj a rool 01 F(X)-YF where Vft|*YMl. As a msult 
Of Ihis, after thrashing in the first couple uF iterations, Ihe search begins to work Jnore or Joss 
correctly. This is probab y why Ih 5 bug was nevff found. Only raze palhoiogical functions tan Cams* 
ca'aslrooni;: 1^iik-rc of tne search, 

This is an e*ample of a definite bug 1hat can he detected by comparing (he operat-ion of the 
program with She ml enjoins Of the proaramm&r, bu1 which is almost impossible 10 detect by looking at 
tne performance Of She program PXl na tesl dala. 

The program HK] his several other bugs similar to the two cilec above. 

ILZ.2 FADING BUGS DYNAMICALLY 

The system reports a bug statically when il s ab.e tci disprove a general claim, or a claim msdo 
by Ihe programme*, aocur t-.e proor^m, ko*rvet". Ihe syste-n csirs not -we an elaOarale deduthon 
mechanism. [1 U5 es mam y paltern matching and trial by example. As a result, it is often reduced lo 
accepting a tlJam on faith. 

The proposed system has the added ability to execute a program in a careful mode where it 
continually checks all fn* dainr.s it was not able lo prove valid. This is essenlialy jus' letting a user 
OF the program indirectly surest what data Hems srould be used in Order to check the claims by 
means 0! trial by example. 

tf a discrepancy is discovered, the system proceeds basic ally Ihe same way as if the bug had 
been found statically through a fortuitous choice Cjf trial by example, The orviy difference is that the 
partial computation can be used to help understand Ihe bug. 

Suppose thai the Iwd bugs described in Ihe last section were not found statically. Th» firsl 
bug would be detected dynamically the iirst lime ^Kl was cali»d with H|«3 and X]*XF. Similarly, the 
second hug would be found 1he first time that the search whs initialed with YN[<YIM. 

I [.2,3 UNDERSTANDING BUGS 

The last two sectors Saikec a&ou1 detecting the existence 0* a problem. Once a problem is 
deteded tl muil be traced back to -.1 w^-a? lo rh.i: i| C3 n " be corrected. 

Most computing environments do a certain amount 0' dynamic bug dete-cfion, For instance, 1hey 
continually check ctaims such as: non-fc*istant memory will npl q C referenced, and division by zero 
will nnt be attempted. IF, for example, an illegal memory referent* occurs, the computing environment 
report a this as a problem. The program^r ihfcn begins the involved process Of finding the source of 
1Kb bug. This system starts Oul more than, ht\l way done with this process because the problems it 
iinda ?re at a much hig.her logical level. 

A useful s.ystem should be able to cOnvsrso with a user about a bug, just as It can about a 
program, ]n addition, il should; be able to present the issues involved so that the user can make 
decisions abo y ( what should be charged, 

The sysSem determines what the relevant issues are by asking itself quesSions. It asks whether 
there was any justification, for lha cla.m which has just turned du1 to be faise. tl so, this justification 
is DbnQvsly spurious. The system tries lo see whfrthcr any pari of it has an Obvious weakness. 
Depending on th* type nf error, the system determines wnat Ihe Other segments involved are. For 
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instance, w/hat is lha source ol the variant input or who will receiv* 1he yjrianl oulpul. 

Consioer the Jirsl que in fiK] discussed above. Suppose 1hat the system discovers slalicelly 
lhaT when KluXF and Ht-B, ANSY«Yt though lha cGramen! in line 21 claims lha; ANSV should equal 3.0. 
The system miE.n1 report (his *; foilOws: 

There is a. deserepancy betwstn the valut o1 AMSV returned hy the 
program, jnd 1he comment on l.ne 21. When H[&XF and H3=£, ANSY=VL v/-.ich is no! 
neccessarily equal to 3.0 even though Hi-0. 

The above cdentiFies the error, but it is not enough. The system should present a mare 
COmpleie cescr pt p-i of wha! is going in at follows; 

The top level slruclure ol Ihe program P.Kl s$ a COND XQR (see section 
RL&2.2). 

H [[FX[±XFTHEN... ELSE [[F H|=3 THEN ... ELSE... ]] h 
This implies ^h*: (H-3 a. *:<y, f) -* £V&v^g,fr 

On |he olher hanr;, t,ne comment* On lines (26,2]? iraicite that the Iod lavg-l 
strut! Ure ol 1he program was intended to be either an AND (see Settion HLki.l). 
"[[F XtetfF THEM ... J AND [IF H|-3 THEN ... ] AND ... " 
Or a CASE XOFr (see section 1113,2:1 >. 

"select 1he One applicable case and pertorm 1he cprrespondinj COmputalitm 
CASE1 KISJCFTHEN- CASE2 H3=0 7H£N ... CASE3 X1*XF * Hli«S THEN _ " 
With eit-,e/ iWuc'jre H>E should always imply U-.a1 ANSY«-@J. 

This descioes t-\e True nature of ;ne destrepancy between the program and Ms annotation, 
The Syslem should go on to volunteer added r elevan1 information such as: 

XliKF and H(=E are not JTiijtually ewclusi*e si1u»tion5 r 
As. s. -f e*U1, 9 CASE XQR is nol reasonable as J he 1op level plan for P.K |, 
Further,, when bolh conditions hold, it is no! possible (Or AN5Y to equal 0,3 as 
Acquired by Jine 2 J and to also equal Y[ as. required by ling 23 when YW&.&, no 
n-.a'ter how ihe program is implemented. 

This I ait statement points direclly at 1he cause 0< the problem Tne system has netted that 
tne cOnimenls orv Itnes <£3 t 2l) are actually contradictory, The most reasonable way to fix this bug is 
to change the comment* since I hey are unreasonable. 

The syslem should give a similar in depih analysis df the second bu£ in RKI. Suppose that the 
system Found, this bug dynamically, ■[ might say scmielhing such as: 

The comment On line 91 indicates (hat it is a prerequisite of the *F E mcn5 
implemented hy line) {$£$$) that YF be belweeft YMZW and VNL. [n thE current 
situation this is not Ihe case even ! hough execulion ol the see^n! implsmenlEd by 
Mi^es (92,93) is about to beam. 

H should be rofed :hat the test OP Uhe 90 tasted only )hat YMEV^YF, The 
proEfammer implied That i1 could he proven that YF it belween YNEW and VN.I 
whenever YF was betwSen YN and YNL and YNEW*YF, Thi& is CitovJousLy not Ihe 
Case. 

The system First dMcrtbeS th* conflict w/hicT has afiseri- Then it identities the theorem which 
hac been used to justify that X.F should m^etd oe belween VNEW and T^l, 

It shoylrf be footed that Ihe system probably wfiJd "ol be aole 1o dcveiOp such a pMhy 
juSlificati-Or, From Ihe pjosram as i1 starts. The syalem wpyld stsrt with a jus^iiicalion bfised On all 01 
the prerequisites OF the segment {Imest SJ-9S), all Ol She assertions 0* IhB segment {lines: S4-8S), 
and tne assertions of line 98. This contains a lot of irrelevant informalion. ]n order to dis^l 1h;s down 
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to 3 concise justification, the system woud probabiy reed issuance from Ihi i,ser, for instance, ihe 
system might ass "Why dees Ihe fact fnal Y|\EW<*F 1rom liu 90 imply thai YF It between VNEW and 
YNJ, as required by lire 91?" The user might answer "Because YF is between WJ and YNL." 

Another piece 01 informal ion the sys'em caLtd jive 1he user woulc oe a counter en ample. The 
system could use the values Ihat 5he variable* currently have from Ihe partial computation 1a guide it 
il Ihe selection af a counler example So Ihe asoue theorem whicn would iHuslrate the proc^em. 

For e K »mpl t . il YN-4i K YF-3, YN>1, and YNEW-2 then clearly YF-3 is between 
YN-4 and YNl-l and YMlW-2 is less than YFn3, hownvtr, YF=3 is no! belwean 
YNEW*2and YN]-1, 

The user could ask for more informatMJn rf he desired, in orda* Id decide whether the lest cin line 90 
Should be charged, Dr , prerequisite requiring thai YtoYftl should be added 1* the search. 

15.3 UTJDEfiSTArJDJMQ MODIFICATIONS 

Tnere- are two main aspects*? modHicalion: dele1iGr\ and" inser Hon. When, something is deleted, 
the system musl as* itself wr.*t d<r?c-nced On ihe- Existence oF the deleled section, whjt loose ends 
have been 1*1 1 dang ling. !f there art no JOOs* ards> 1hen Ihe seel ion must not have been used J or 
anything. 

When a section is uuvrlBd the system must ask itseif 1wo questions-, "What cOntribuliOn is this 
section going to unahe?" ar-d "What problems is it going tu cause?" The system c.-ir ec! ninls about 
the answer to the firs! question, lay knowing |nat a sfcclion is replacing anolher, or supposedly lining, a 
bug. 

There aie many potenlial problerrs lhat a niodsficafcicn may cause. Gonlrol or data f ow oaths 
may be cisrupled. Needed assertions may be celeled or cantradided. This could cause justiFJcaliOns 
to become- invaiid. E1 can be seen that a lol ol work is required in order to assess the ramifications of 
a modification, however, it should also DC nolfrd that a lot Ot 1his same type of work is required when 
the system *naiyzes toe program in 1he firsl place, 

Consider some examp-ies oF how She system mighl respond to a suggested modification. 

2SJ What would happen it line -3Q we^e defied? 

[n the sttuatiOns where XliXF ar HSjiE, the ar 3 un-,?nt 1o Rkl corresponding to 
the variable ]f.R" would be relumed unmodified. This contradicts the comments: 
on tines U?,L£,2&21) which slates that IER should be @L 

Z5} What would happ&n it Jfjfe 31 ivcrc Changed to 
'IF (XF-XI) JIJ2JZ*? 

"he new program WDutd be drfierenl in that tins segment {lines: 32-33} would 

Only be executed when X3>KF and the ies1 oi 1he program would be eneculed 

when XI-XF as well as when XKXF. 

When X]=KF and HL-0, then 1ER woLld equal 1 and ANSY WOukd equal 8.S 

whereas, ]ER=@ and ANSY«Y| in 1ha unr=iodiSied program. 

When Xt-XF and. H]^0, il seems Cttoygh ] (!ho- system) cannot prove it) (hat It is 

still the case thai ANSX*Kl and ANBY-Yt as required by the comment on line 20. 

£7) W/iat fJ your justification far ttis fast St&tGment? 

Assuming S|=XF and M^3, tr*n for all of the enair&le^ ] Clhe system) have lried h 
that loop (linesi ^'53> 67-?l) lerminates on the first iteration with 
XftH*X[+HNEW}>KF. This causes this segment (lines: $ff-6fl> to be axeculed. 
Again for all oi 1he values [ 4 the system} have thnsen, MNE^ff and tharelOre 
ANBX-KX.-XN-+3«X[=XF fl nd A/MSY-YY-f(3(Xj-F(;Kl}-Yl. 

It is entirely possible 1hat the s-ystam would actually be #&le 10 prove the *ssar1iOrk II is 
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i^T'S; rr e ^u ? h ^ th *, V,fy Simflle dBdueliw metft ^> tri *' ^ ™™P*« and sub a (itut.On of 
equals, lesd 10 a such lucid explanation of what it happen n& 

*bo™^ C&nSid " mCdJ ' JCltiCns Whith ™S h[ b * P'^P^rf « fin« f0' »** two tug. in JS^Cl discussed 
2tfJ What maid happen if line 22 were chaffed to 

-c orwf/juisE jf flf.-?fflo rw™ rf*--j, awsx.-x;, aw ms^--^c 

This would eliminate the by* by remowing ihe cpnfk] between the Old line £1 
>nd the tpp- level jtfirclure qi (he proai-im, 

Nola< comrnenla as wa J| a * c «da may be- nsOdiFied. 

£W What if the feat ;„ |f fle go were e ft fln ™j £o 

'IF (YF-YttEW) UQjlSOJW? 

HJh* sysfe-M assume you int*nd lo claim thai M is tfu* 1hi1 whe« XF is 

between YN antf YN1 and YF^YNEW 1h en Vr is betaern YTJEW and YN1 

This is ti-ue for the «» nP te wh ?c h brought up ihe bu fi . H&wever, it aJsO has 

caunter-exampl^ lor insljnce. wher. YM-l, YF-? F YMEW-3 and VPJI--A. 

J0J WhJt if the test ?rne 90 is chanoed to 
"If (tYtifW-YFMfF-YNW mjSQilZG"? 

A* fir as I {(he iyslem) can Jell, this 1i> es Ihe bug wrthou) disrupting any of the 
Othef uses of line 93. 
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IIL HCW THE SYSTEM vVG3K5 

This paper is a proposal. At a result, Shis seclion claims 1d be neither tpmplele nor completely 
accurate. It Only l^ies 10 show Iha1 it should be possible ta acheve the behavior described in the 
rest Of Ihis paper, Wi1h thus in mine; consider (he fallowing qescripton ol how the syslem mighl 
work, 

Tho system cnflfitrutts. a logical structure, the grand plar\ for a program, This structure shows- 
how the proljiem OF achieving ]he goat of the entire program Fs reduced, though the program, to 
subproblems wri»eh can be achieved by primilive programs ivaJabl* ijn the programming enYironment- 

The grand plan is a tree. Each node is a plan euplaFning how a goa>l it decomposed into 
subgoals, th» plans (or which are the daughters 0? 1he nbde. The lenses are goals achievable by 
primitive programs. 

Each part Pi the program is sinhed with Ihe pieced ol 1he grand plan, which il implements. 
Each. part is explained by this link. Questions about a pari pf the prolan are referred to Ihe 
corresponding perl of the grand p^an m ordfi' to be answered. 

Hi,l DECOMPOSITION OF A PflQGflAM 

A program is decomposed i«td seclions fpllowirtg }fe structure of its gra^d plah. 

ril.1.1 SEGMENTS 

The £0*1 associated with a rode,. Or leal, of the grand plan is referred 1p as a "segment of the 
main goal," The scl Pi pari? of (h» program which are associated wilh 1his node, and its Cfeeendanls, 
is referred to as a "segment qf Th» program/ the program segment which implements Ihe goal 
segmenl, [n this paper the f*rm 'sc R Tijrtt H is used to re-f*r lo bolh 1he goal segment and the 
corresponding, program segment. 

In general, s program will have a basic lrtc-like slmclure closely parallel lo the 5 true lure o( It? 
grand plan. However, many transformations are camrnoniy applied to a p'0£.'a>r ii trd^r to ir*crease 
•Ie efficiency ts*c SecliOn ] [1.1.31. These tiar-siormalians obscure tht basic parallel. As a resuH, * 
program segrrient f^^ ni0t OB a 4 j mja | e continuous piece o1 Ihe orogrjm. Jt may be spread here and 
1here through 1he code, tn add-Mion, pr,e piece oF code may be contained Fn several logically 
non-ove Mapping segments. 

The cede for a given sesmijnl, with the res) of th# program deleteo, forms a new program 
which implements the corresponding, foal, further,, \\ is a property ol the way thFs system chooses 
segments that each ssgmenl has only one cnlry and on.y D-e em? path. In olher words, no 
information <& encoded in the How of control into or out of a segrrent. Each se^menl ot a program is 
described by a behavioral description (see secliOn ]L].£. ]>. 

HI. 1.1.1 A SMALL EXAMPLE 

Thts seel ion presenls an example OS 1he relalionship hetween a program and its Brand plan. 
Section [I1.4.S discusses tha grand plan lor a morn cOmp ! e!f program. 

Consioer a ie£mc-,; of code which compulss Ihe reels of a cuad-alic polynomial which is 
assumed 1o have reaL rools. E1 taV.es as input Ene corHicienlE A, B, a"d C and oulpuls Ihe roots Rl 
and R%. 

- SORT <B**£~4wA*0 
fll 1 (-B+Di/r.2*A) 
m - (-B-D>/[2*A> 

Fig 3: A program wh*ch linds the roots ni a qmddr aUc p&lyno-iiial. 

The following it a possible grand plan for this program. Each node has a nafe of 1he ;o?m Gn. 
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The mods specifies tne goal wh^ch Ft achieves, a.-sd a pl*n [or how to achieve it. 

Gi; "calculate the fools" ta da t- :; «i eve G2 and 03 

G2: "calculate first roDl'tampcs* the goals G4 and G5 

G4: "calculate this square rool lerm" 0»5QRTCBt*2-4*A*C) 

G&: Vt the Jjrs-t rOtt* R]-(-B+Di/f.2*A) 
G3: "ca-kulale seca-'vd root" cenpcsB 1he &Oals G6 and G7 

C6: "cakulale 1he square r-pal lerm" D*SQRt(3*jZ-4*AiCJ 

G7: ~g*t the secOr-d rool" RM-B-DV(2*A) 

fig 4t A erar-d plan For iirwaing Eh* roots cd a quadratic polynan-ial 

Tile final figure in ihis section shows haw th* progjajn to segmented,, and how these see.**rkts 
correspond t-o goals in the grand- plan. 

prc.gra.ti serpen 1 5 code 

PI P2 P3P4 PS D - 5QFT(B**2-<i*A>iG) 

PI P2 P£ R: - (-&+B]/t2*A> 

PI P3 P7 R2. - I-B-DJ/IZmA} 

Fig 5: Ttus shaws the carjespande-TSe pfclwesn the program and the £rand 
plan. The projrjim segment Pi achieves the goal Gi, Th? prcgrsn segment name 
appears belofe each li."w ton lamed in it, 

No1e 1hat due lo di-doring (see satt^n ltLL.3,3), segment P3 is not continuous, and (he first tine 
irnplamenls bo1h P4 and P6, which ar& logically non-overlap-pin^ segments. 

[[[. L2 conm:ct]ve TISSUE 

Consider a. program segment P correspond^ to a goal G. The segment P conlains subsegmgnls 
Pi which achieve 1he SudgOals Gi of G- The segnrinl P also contains cade which is net contained in 
any suhsegment. This ewcess code is connective 1 issue. Lt is I he cem&nl which binds Bubsagrrflnls 
together jo Jorm » larger segment achieves a. rrflro SPmpJev goal. 

The goal of a segment is achieved by txueuiirtg a sal ol subse&rnenH, However, the 
subserjmenls are not just executed in a vacuum. Tr-ty mijsl hava information conveyed to |hem, irom 
them, and between tiem. [n addition, 1hey musl be enecy5ed m 1he correct sequence. 

Ill- 1,2.1 DATA FLOWCONKECrrVETJSSUE 

Data (low connective tissua carries dala items belween segments. It carries dala Irom the 
Output ot one se$men1 to the intpul of another sefment. from the otitput oi a Subsejment To the 
Output uf Ihe combining sc-sinen", ano ; rcm the np.,1 ol a ssg-nent to trc- .npul of a subsegnnnt. 

The most common dala 1lo* cor^'uds. whith lOrm Ihese pathways gr* Subi'Out'he arguments, 
returned values, free and bound variables, »nd assignrrent. these eanslructs ian be chamed logether 
sP tnat a 03tun> can Sallow a path consisting el many sectiPns from its SOu'C* (0 ils da-sti nation. 

191.1,2.2 COWTfiQL FLOW CDNNEGTIVE TtSSGE 

Static conlrel 1low connective!, s^h as GOTO, CALL, RETURN, and physical sequential placement 
of statements, fin a c-atle r n Of execution, [n ^ddilion, dynamsc control Flow connectives, MJCh fti DO 
and various IF*, perform computations by varying 1h& p^tlern of execution. Tn this System, the Key 
adions. of dynjmic conlrPL flow a"e caplured in 1he notic-. 0' a predicate, which is used explicitly in 
-several plan types, 

A predicaia is a hybrid construct formed hy wrapping a. segment in dynamic control How 
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constructs. A predicate has no eHplicil outputs, however it eayse= tOnlroJ to exil via one ol two 
pains. On an C palh it make* the output *s*er1ion P and or, I he other *P. The output js in effect 
encoded in the Maw of can Ira I. 

Predicate* are Only used in csrtein plan |ypes> whart the way I hey contribute to the overall 
5041 is made explicit. This makes j( easier to ungetslird the Junction OF predicate*. 

!k[.i.3 PRG3RAU TRANSFORMATIONS 

One of the firmest p'obiem; in recagnizirg the basic structure Of a program is I hit, for * 
variety Of reasons. pieces 01 the code are shuffled around wnen Ihe basic plan is implemented. The 
primary molivaliOn for this is economy. Putts are moved so thai they meed not be redundantly 
executed, Pieces are also often moved so that they need no1 be redundantly wnlten, ever, if this 
increases eneegtian liene. 

The Iransfonved p'ogra-r iflomi ihe sa^ne essemial c»lcula1i0-n. However, it usually has 
incidental drtFerences, complexities, and redundancies which .may lead ;o tug* wher| il is modified, or 
incorporated in a la?£er program. 

This system attempls lo detect transferal itns as it devejops (he r>rar>d plan for a program. It 
cert "L...I y tries lc gel .il I-:; u nde- lying legica ?- .ct...r C n' .=, oro^'am. 

111.1.3.1 REARRANGEMENT 

Consider the primitive pieces at cede which form a progra/it, They form indivisible units 
impiementjng the loji-CSJ segmen1s which are leaves Of Ine grand plan, Cenr^ctiva tissue links these 
pieces together mle a program. Tr* oortlroi (Sow connective t<!tue forms a directed %r aph, each noce 
of which is e^e^uted Only in a certain set of situations. 

A given piece- at code cars usually be pU in any oF several posiliOns an 1ha flow of control. In 
fact, the placement is constrained in only two wayi. Firsl {he date r^s provide a pari *l ordering Icr 
the fundamertUl pieces d code. A piece 01 coce rr.usl Be srijiled so Iha1 it lollops (in the Order of 
Gxflculion) any piece 01 code which provides date lor it, and precedes Lin Ihe order of execution) any 
piece Of code which uses data output from it. 5ac0ndJy„ the grand plan spec-f es what subset al 
£ilL.-alions each piece ol cede shrjySd be executed ir. A p eca ol code is constrained to pOs Miens in the 
control flow which cause eaeculion only m the correct situations. That is 1o say, a piece of code 
which should only be executed some OF the 'imes 1hat Ihe program as a whole is executed (for 
example one of Ihe alternatives of an |F|^ must be pul m a section o* the topological control flow 
structure which is executed at |ust those tim&s. 

Clearly the grand plan only loosely reslrids the pcniliar. of the pieces Of. code. One reasonable 
W*y 10 decide on 1he exact sequence is to f equine 1h*t pieces oF code whjch inapieuwrt the same 
logical segment be togelher, This makes 1he relationship between 1he grand plan *nd 1h* program 
clear, but it is sometimes wasteful. 

It should be mentioned lhat programmer* often desire even more flexibility in placement than 
thai which is described above. There is no way 1p get around Ihe da:a flow con^r^inls except for 
Changing the aigOritnm, and hente the grand plan, however, ihp c&ntrbl constraints can be loosened. 
It is possible to position a piece of C&de so that il is e*eeVed too ofien> as long as its results can be- 
ignorcd in tne artra cases. For in^ance, 1hey can be ignored if, m the extra cases, another section Of 
code tverndes 1hem. 

[t should be noted thai stretching the grounds lor rearrangement in this way is dangerous. II 
tan lead lo bugs hec»vS* it creates eidraneaus situations which ace peripheral to Ihe main goal. 
Thirty c-Ome inlP being whose so c Lndion is to tin th ngs up iiUcr somelhing has been moved. 
These ;hr^L tan easily gel mislaid at misuno>rjToed, causing bugs. 

lEI.I^S.-a SUFJSTiTUTIOM 

A section of cod* can always be substituted (ar another section ol code as long as il does 
exactly the same thing in tr* £\ybt\ situalion. This is nal terribly useful, however, a section 01 cOoe 
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cat! also ba substituted if it -docs mO r e thin is rehired* as Ipnj as the- evtr* WOfR CM b* ^gneredL II 
can be ignored by either throwing it away, qr by overriding if at * later time, This lype of 
SUbsUluLiOn it useful in utilizing pre*e!iis1ing sections of code, II is also useM in promoting 
lacToriiattOn {see belOw). 

Just *t In rearrangement, stretch!^ 1he silualiorv can lead to laler troubles. Fnr inslance, the 
requirements tar ignoring the e*tra work can *iv\y gftl losl in the shuille because Ihey are 
peripheral 1d the main task. A ! sO same othe.' program r>e>y Ovenlually come '0 deperd On One 01 the 
ajflrnreoLS lear-jre^. This can lead to future prOble-ns, since the Anginal program does not guarantee 
the exlranegus features, they may go away at any time. 

There is a special case o ; iu.-v.ti lutein which deserves nale. Often the &rand pl*n wilt call lor a 
general routine, ho-wevar, the situation mike* il dtar 1hal 1hg eclions 01 the routine will be limited Id 
a ayflie-t Of Ms normal actior^. ]n this situation, a more restricted roullne can be subs-1'1 uted. 
Sometimes, the routine can be elirninat&d en!*rely because its inputs are sp heavily constrained that 
Only one aF the 0Ul0u1s is possible. 

111-1.3.3 FACTORING IN SPACE 

Here, two Or more identical sections of tode are replaced by one insiance oF the section of 
tode. This saves redundancy in wrilinj Che pfojrim. Consider |wrj sections OF cade which have She 
same specific aliens, and ^nieh are in paraileE positions in th* flow of control, Thai is 1d say, in a 
ai^*r> siluation either one, hul "01 both,, OF the sections i? e«Cuted, The two sections can be 
replaced Py Ore sectloi (.identical tp them) m a posilio" 1hat s e*ecg1eo in ju*t the umOn of lbs 
situations Shit Ihe Original two were executed in. Ln addit<rdn h Of course, this flew position must be 
such 1hat the data (low restriction a/e met. 

4B 



A 



hi - ^ A2 



% 



Fig. Fj; Two identical pieces oF code at M and A2 cap be Factored Forward 
to position B, Or backward to position C, as long as the ns* position is consistent 
with data flow constraints. 

SoThi of I he methods of stretching di«u*5Fd »bOve can be used here to promote factoring. 
First, substitution can be used to make diss milar pieces of COdt idanlieal. Second, a segment can be 
factored to a poin] thai is executed tco OlFen as hrj as She resulls can be ignored in the addilianal 
sMualions. Finally, faetormg r.?.n be generalized to factoring ou! pf n parallel! pOsi1i0ns h rather than 
just two. 

It should bo noted 1ha1 (BcSorinj is a process which causes. One p'ece of cede to perform two 
or more functions, which, afe logically unrelated A (adored piece OF code performs all of. the aclions 
which were plrformed by its antecedents aa a group, 5ir.ee the anlecedents were in parallel 
positions, their 1 actons were associated witn Icjica ly di-sSmct sifust unr-, 

IIL1J3.A FACTORIrJS [hj TtME 

Here a sectJOn 01 code can be moved out of t position, whare it is executed many times, to one 
wnere it is executed Only Once, as long as the result of its AKecutrOn is the same each lime i| it 
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eneculed. The archetypical case of Shis 
noted that this 1/p« of factoring c S a a |- 
pieots ol code, wJEh the safr* input, is explicit. 



us i$ movjns something out o-F a loop How fever it ahnulH h* 
-led that this 1„« OF factor!,* W also b* used when the r* P eftive ,.L edition of toSfcJ 



-f- B 

-I 

a; 



4- a 



■■ Al 



■ ■c 



F,g 7: Preces Pi code with identical r«,ul1* (syeh. as 1huse at Al and AZ> em 

be .emporaly factored t&rwa^d 10 3 or cachward to C 
constraints are met, 



as Jong as. data trow 



Ii j ^;r";: "r,^ tf * * e »- - i - fi ^ « ^ '«*™.. T , s ^e^, 



nuri «« «totata dat* Flow «n 5 |rain ti| and the n™ oosifon muS F be ««utotf 



ovary lirrc aiy of the 



.."■ ada.hon, as above, things can be stretched ard gei*« ra |.zed to n 



o-ld posilmris were *xatute-d. 
pieces oF cade, 

resu^^A^Y^ '"l" ^ *? ° f '"^^ U * M "»' "^ 0ccu " to ™* ^ *** «***. if the 

results of AS and A£ gr * rw,t used until alter po.nl C, Shen Al i B eJe*rly reriundml. 

HI-L3 ■> WV]NG COfciPUTATlWJ BETWEEN THE COD- A*D THE FLQW OF CONTROL 

the ilJtortVJ !T1 X ^Jf^ h can e,t ™ *» WW ^ fundion., or dlrtttly implemented ,* 
I»m^ =. IpT'J" * J trai 5^^rd e^le oF this J5 a |<,,,<,| connect M h « fl.ND or OP. For 
"""?' ? 1 "l *< 3 V V<B ^uld be i,*pl*™ntea using or* Jo eJ r.ai W r« M r Or by iX lw & 
«parale tfrsts branching to the ^ ptete . Th ls syiC4;ir 5h&u | d be able i fl r«aarf« 1 Si Nieu wo 
implementations perform essen1i.ll-,, ihe .an* ^p.Fation. r«n S n.« 1hat tr,e.* two 

„ DH , L °? hmE *} '* Snelher w ** P D£i1ien ir * lJ * "0-* ol control can t* used to encode inJofffi.tHfi ffe* 
! V "* ,t " rrtu ™ d Ufllue ,n *'** d This dually leads io a si ^NHctiOn oF the flow B ™»™™" 

caie fl dffd bmarv c h 0lfift5 . , -, IS lS p a M.ru.arly c onfu^in 3 whs.-, tie lw D era 
111,1.3.6 MOVrra OQMPUTATJ0N 6ETWEEN THE COOS AND THE DATA FLOW 



ilttfi are Josically uinre-lsted. 



<S beini i™ tK^d ? . L? ,lh ' a E ° trjn&mit * dltUm f '° m ° na pl « B t0 flM ^ hor ' Wh *" this 

la w +2 f " n ' : ™ dlf '* d by if£ J&Urne >'- kftwsvef - d * ;a 1l ^ Paths ca^ be cQnstrMCted 

no.[ Be ,ne j^ma as Frm one which entered 1he jath. 

For a if ample, various devices, Such as calling a subroutine with arguments of nonma-tchiiu tvoes 

« r?h™ B 1 fU T i<>r,S 3rt UE9d : ° £ ' 5r ° Snd reE " ftV9 * d *- j! -V be transformed by Ihede 
path, Th>s s yS ten treats Ihis as if axpi M tr.nsfnrmat^n. bed baen used This h™ ihe Efflrl a! 
factor-^ Ihe computation back ou! ot Ihe data flow. 
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Data flow p;pths can alto be used as a syntatliC method for specifying that ee.fta.in, conveniens 
should be performed Fd* mslanc* lhe stalerr*n| "S-O" [wh#r B S is single precision and is double 
precision) will Cause the FORTRAN cfimpjler to inseM t tJnvfiifin from double to single precision. 
TW( iyileirt just trea1s Shis *$ if the conversion wji$ explicitly slated in 1he first place. 

FORTRAN has t.-.e pawerful construct "EOUEVAlEKl" and "COMMON" whicn cajse 1*5 or more 
vi^bles. to refer 1q tha same sedion of memory. They cart he utcct (5 cause different sels of access 
fiirtelicns lo be used Qn the sane datum,, and 10r Gthe* useFul things, However, 1hey can also bring 
about, Opaque and compie* ?idc eflects. Imlialiy, this system will no1 try to deal wilh the dttFicuMies 
associated i*r(h EQUIVALENCE afid COMMQM [t will assume mat every va'iable is distinct, i*. that Ih* 
vjlue held by a variable can never be modifrad oy in operation on a variable wilh a diHerent nari»e r 

Another issue is brought up by arrays, wh ch are the only non-atomic data item available in 
FORTRAN'. Or,e way to look at an array reference h AM>" is that it is * Junction which takes two 
araumenis, the array and I he index, at>.<$ returns a reference 16 the element of She array, Another 
way to fOGk al it is as a name for tne selected Hem, and hence a dala f ow path for that iter, alone. 
The second approach has the- advantage IhaS, wheft re1nevm£ %n& storing a va'-us in an array element, 
it Captures the notion that the otfter elements 0« the array are unaffected, ]h the hrsl view, the 
array indexing is part ol the computation. In th* sacOnd view, it is part ot She data flow. 

As * concrele example of She difference between the 1w0 views consider the seamen) "A{[)-2." 
In Ihe COmpulalionat view h 1hi? segment likes lwQ inputs, A and ]„ and produces a/i cJulp-ul matrix 
which it idenlical to A «n all elamenls e^ept th* 1'th. which is set to 2. In the d*t* flow view, the 
segment has no inpuis. A 5 an oulpU, i1 has only fne tingle eleme-t A(l) which happens to be pari of 
an array, and is s.e1 to 2. 

The second approach makes iE eislir to udders! a«d what is. goi/it on, but i] can only be used, 
when the value of I, arid hence the identity of AW, can be determiived at 1he tirr* el the analysis. In 
parlicular I hi t means 1ha1 ] carina; depend on ihe value of any dalum comng from outside ol tf»e 
program being a.nalyEcsd, When analyzing She segmanl above, the system would start wilh She 
compulation*! view, and then =wi|(r, tg ;h e data flew view il IS discovered 1hal it Jtnew Ihr value Of L 
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llf-2 THE STRUCTLRES USEO TO DESCRIBE A SEGMENT 

As wa-s said above, Ihe gr^ ".d ptan far a program show* how the goa dF the program is 
decomposed, step by slep, tp goals achievable by primitive programs. Further, each node Of 1he 
g r anc pkn ii 41 plgn exo^i-irj ho* a gaa. is cetompoiied into s-ub^oals. Lt is now time to look a1 1he 
precipe structure of 6 plan. To lhat end, the nexl secbon details the slrucLura Of behavioral 
destNpliOns. They doscrihe 1he inpU/Output behavior Of segments, and form an integral pari of 
plans, 

III.S.1 BEHAVIORAL DESCRIPTORS 

A Zl'r&i a-., I fjescr P .| ■ COn;; ■,:■ <:l Iive pa'lsi ? Stl 3f i-:.fj: ie-i 1-. 5 itl D 4 JX.Ip.l ilcrv/., ;i ■;:-! 
of prerequisites, • set dF assertions, %t4 a mapping. The prerequisites a'e logical conditions involving 
th# input ahjeds, They musl be me1 if the segmenl is 16 behave corredly. The assertion? jirr t; = cjh 
statements which art trua alter compel on of the segment, [n terms OF the input a no output items, 
the KS*rt<Pns say whit the segment dues when the prerequisites art Jr*L Note particularly, Shat the 
definition of a behavioral description speaks o! input and output hems, not variables, An item is a 
place of information (a number or an »rrjy or a function} which is passed between s^mcnls., A 
variable is jut: :he. mosl common data 1low conshutl. The mapping specifies when an output item is 
iden'ical 1o an input item, 

Segment 

VN1 - FttWII 

XN1 - XH14DX 

Benavioral e^sGrjptiOn 0' "he segment 
nouts: k, f\t 

prerequisites: floating number* (x,. inc) 
Oulputs; newy, newy, pine 
assertions: iloalina numbers (new*, newy) 

ne wk »v t-inc 

newy"FfKj 

Oinc"inc 
mapping: foinc++inc) 

F7g. S: An example of a behavioral description for a 1wd line segmenl. The 
lower case names (lor example if, inc. news) are names for items.. Any similarity 
between Shesa names, and Ihe variable r, a jnes in She example se£m<?n1 ,$. j u ^( tor 
Ihe convenience 01 1he reacer. The system encodes no jn10rma(inn in the names- 

]f a behavioral des<r iption accurately describes a segment, then If the inputs are supplied and 
the prerequisites satisfied, the Outers will appear, and the assertions wiil be true. In order to justify 
tht Claim that a given behavioral description is accurate, 1h* system musl iook at the internal 
structure Of 1he segment, The mapping is oF assis lance since anything which is true or an item under 
one name, is true- under another name. The system knows, in advance, behavioral descriptions Of all 
01 the basic programs available in FORTRAN. 

111,2.1. i POINTS OF VSlTW 

To be useful, a behavioral description must be accurate. However, exactly wtial is put into a 
behavioral description is a function of the purpose to which Ihe behavioral descriptors will be put. 
One segment can be described From many points of view, and several segments can ae described fforq 
a common point of view. 

There are two key types ol poinls Of view; ■jntrinslc'' and "esrtifjnsic." An inlrin&ic behavioral 
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description descriOes n segment from an internal poml of view. ]L references nolhing exlernal to IK* 
5ee,rfc6rt!, fverylhing it says about ifa sejmfrnt ll true by virtue of the Stefan's inlrjrnal workings 
and i; independent 01 wherry how, a-,rj why the seiirient is Used. 

An #*[rinEic behavioral descrtption describes * segment from an externa! point of view, [t 
references not-iing internal to 1he seamen!. 31 descriees thi Mgffliflt in terms of the envi rsnme n1 of 
its use-. An extrinsic behavioral description is only used In conjunction w4h cLher entfir.sk behavioral 
descriptions sharing the sfl-fr* pom: of view. 

11 1.2. 1.2 RELATING BEHAVIORAL DESCRIPTIONS 

Given nwo behav o.'ai c'^r pliant foi- a jiv 5 n segment,, it may by desirable to show how they 
correspond. This is Son* be specifying, an addilionai mapping which shows ha* Ihe items rnenliOnad 
in Ihe I wo descriptions correspond. 

The naxt Fifiur-e shows an extrinsic behavioral cescriplion for the segment in Ihe trample 
above. A correspondence mspoir-.a is include^ as pa-r pi lis mapping component, which relates it to 
the intrinsic behaviors, description ol ihfc segment in 'he previous figure. 

Segment 

W - KNI 
VN - VWI 
VN1 - FM21) 
MM - NH1+CK 

Exlrinsk description 01 1he searrent 
input;: *, >. deltas 
pre requisi Esse floating. n-jfiT^eri (k, y, deli ay J 

H.B<delUx 
outputs: resctx, nesty, old*, oldy 
assertions: fFoating numbers fritrt^ iwxly, alda h oJdry) 

fl9KtV"K+delCjK 

riBjfty^Ftx) 
old*** 

Oldy=y 

nesi t^oldx 
friappingj (***, detail -;:, nefctx^newij, nexty^nevvy; old*"*, olaty*»y) 

Fig. §: This is an fljcampLe of an extrinsic behavioral description Of a use of 
Ihe se 3 men1 whose infringe behavioral desnplion ie grven in the last figure. Dala 
flpw connective tissue has been added Co traale more oulputs. Similarly 
prerequisites have beer. adced, yielding irort complex assertions abOul rexlx. The 
mappir£ cemporenl consists ol two parts separated by a semicolon. The first pari 
shows ho* 1 names used in ;he BKtrinsic description map to narres used in thE 
intrinsic description. The seconc shows how names in Ihe aytrinsit description 
directly map together. Anything which is sud ct a name ia true ier any name il Is 
mapped to and vice versa. Any identity belween eidrinsic jnd intrinsic names is 
accioental and carries no inforrnalicn. The mapp.ng carries the inlormaliOn. 

The correspondence mapping enables tn* syslem 1o use Ihe fact that 1he intrinsic hehavioral 
description is accuralo 1o heip s.iow lhat the exlnnsie behavioral description is accurals. The 
extrinsic behavioral description is accurate if In* intrinsic behavioral description is accurate ard 1he 
following iojr requirements are met. 

First, each item in the intrinsic inputs must be mapped to by an element ol the extrinsic inputs. 
Second, each element of the eirt«nsic outputs musl be mapped to by an element of |he intrinsic 
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OulpuEt or directly from a member el the eiftrfnsb? input*, kavihr* an exlri-nsic output tome dtredly 
from an extrinsic input is 1 common melhOd Of estentfing the intrins c abilOes o1 a seorrcnt. Third, 
fno esrlrins.c prerequisites, must imply th& inlrinsic prerequisites, [f not, the segment I* buns 
^correctly used. Finally the enlrinsiC assertion? musl he implied by Ihe inlrinsic assertions, and the 
extrinsic prerequisites. II not, (here is no basis for isSBitina Shem. 
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Fig. 10; This figure Shows a schematic repudiation oF the felatiOnship 
betwaen intrinsic snd exlrinsic destuplio-.s o1 a segment To the ngnt, equations 
summarize the Key relalinnships amon* Hib exlrisisic and intrinsic inputs, a u: puis, 
prerequisites, a*d a*ser!.a."s. Throughout (he resl of this paper, subscripts will be 
used m .a refer to I he inpula, Oulputs, prerequisites, ins asserlidns of the behavioral 
description of * segment. ]n the fc&ure, "X" stands for (he eictrinsic name q! the 
$*Emonl, and "]" for 1he intrinsic name. Therefore, *tt n ~ Stands tor the outputs, of 
the extrinsic behavioral description of the segment. 



1II-2.Z PLANS 



The plan for a sea^ehl shows how She behavior Of 1he segment is produced through (he 
combined elforl 01 a set of EjbsegTsn:s, ]t £Ons.s;s Of fo^' pa.'Fs. 

Firstly, it lists e*tr*nsie descriptions of the subsegfrients (rOm a common point of visw. These 
describe the behavior of the subsegmeAft in (he conlent of (ne Outer segment. Secondly, the plan 
;ntlgdes the intrinsic description of the se&mfrnl a-, a who e, frorr Ihe 5 sure- point of view. This is She 
goal to he acheved. "Thirdly, there is art ind*ca! On Of the plan type, of the plan amd of how (he 
sgbsegjrienTs map into the components dF thai plan type. Finailv there is a description of the 
leleoloanal ttrudure ol Ihe plan, The SelecNogical si rue lure contains the hey information which allows 
The system to Know why 1he program is the *ay it is. 

For each plan type there is a colledion ot rpeciSic -nelhoos and mtormalion {see section H1.3JL 
This knowledge specifies how sgbs»^rr* n ts inlerar.1 in accordance with the plan Type. II shows what 
control and dala flow are required, tarn impOrtanlly.it sho*s how the evtrinsic descriptions of the 
s,L,bnnam B nts are lojita'ly coinoined m orcrr lo y eld the intrinsic description ol the s^E^enS as a 
whs e. :t mdivales r D w to s p ^bCu: verifying thai 1he segrrent as a wftple wO^ks correctly, *nd whal 
some qF the common bugs ate in prOg'siss usii-g. Jhjc plan type. 

Looking al plans fforn another point et view, a plan a an instantiation ol a plan lypa. The 
oxtrfntk b#havioral descriptions instantiale the Subsegmanls. Dal a item naming c-orwenJions 
ins;antiate the data flow. Sufisegment naming contentions z PBt ;\iy She con(rfjl flow through reference 
to 1he plan type, Finally the intriny.c behavioral cescription p! r,-? ouler segment, together with the 
description o! the ttleOlOgical structure, mslantiale Ihe pgi-sal Slructufe OF the plan (yoe. 

The telea.ogicat strueturi it dsacribed using a ne! of 1wO kinds of linKs ("purpose,' and 
"reason*). Purpose links specify the purpose of ^ teatuce ol the plan. They are Inlended to show 
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why the major cesien decisions were made, fli a resull, only the main ^oat directed features have 
purpose links. U should he- noled, thai a feature that dOee nOl have an avowed purpose may still ho 
usee as s, justification for saftiething. U it is not used lor any1hk.£,, Irian it is jus! incident*! (the/c aro 
many incidental features in a typical program}. |n (he example plan, il is not just incidental that ]he 
function F produces a floating number outpul. however, it is not its purpose eilhar. E1s purpose is to 
compute the function F as. required by 'he inirins* description of tt* outer segment. 

Purpose Jinks BhOw outputs designed to become irtpule to- Olher subsegmenls and/or outputs af 
1ha outer 5-e.g.menL They show assertions s *1is.rying; pre-'aquishes of Olher subsegrinenls and/or a#irt£ 
used to imply asfierliOna of the ouler se'rnent's bahao-iOraJ descr-pliOn. They also show more global 
ideas, for instance, that a particular subsegftient detifrnines whether a Icdp should lerrmnele.- In 
addition, purpose links show that 1he inputs and prerequisite? o< the intrinsic behavioral descriplion 
of the outer segment are designed 1* prgv de For inputs and prerequisites -of sub-segments. 

The- reason links c-srplain why certain 1hirt£s can be Maimed. In particular they mdicntc- why the 
assertions of |he intrinsic behavior 3- descripiinn of the owrer segment can be claimed and why f.-ic 
pre* equisifes of the extrinsic behavioral dwscriplJons- OF 1he subseaments will be salisiied. They show 
the hey sot Of asserlions IrOm which another assertion Can be inierred. 

Taken together, the reason links are a trace oF 3 prooF OF correctness for the segment. This 
system is unable to verrfy tras prOOF because it fflMSl tiK* fnany reason links cm ftith due to (he fact 
that Lt cannot prove that I hey are valid 
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Segment 

YNi - Fffflfll 

Plan to,' Iht- segment which is cF type AND 
UD PE4 PUF1 Extrinsic deserrpljcm d1 pa/ 1 AL of A (F) 

Inputs; v 

prerequisites: FI^s-Ling. number (k) 
aulputti ne wr- 
asse rhona; f baling number (rvewy) 

newy-'fa) 
mapping: (ne-wsi++si-^.L h nawy+relurr^vaJue,) 
Exlnns.c der.cn^lon cf oart A2 of A 40 

inputf: v F ;■■: 

prerequisites: Hotting numbers (n, inc) 

Outputs: nf'vv 

itatrliOfw; floating number (njWK> 

n*w!f"x+inc 
mapping: <K*+(rgl, 3nc*+arg2, new K++r d um_valuei.} 
Infringe description of part A Ot A (the whole se^monO 
inputs; *, inc 

ord-tqyi sites: flcaling numbers (x, inc) 
outputs: nr*if. nawy 
assertions: floating numbers (new*, ntwy) 

newxwtf+int 

nowy"?(xJ 

Fjj, 11: Thia is, in e^mple pjan For segments simitar too the One dealt wilh 
in the list two Jig-urea, No1e that here 111* ninis 10r 1he hems do hava rrteaninB 
because all Qf the behjuioral description:: have a common poin1 of view. If they 
are the s*mc in two diife/enl description^ then they refer ta the s^me iten*. The 
table to the l«tt 01 Ihe ti&ut* indicates the teleologfctl links. For enamp!e, tjna S 
K*s producing the outjiul in line 13 at i1s purpose, and lift* 7 cites line- 1? as th* 
reason i1 expects to b B satisfied. Section UL3.1A summarises iha specific 
knowledge 'Or plan type AND. 

[I ? plan is to be applied La a partial** sugmenl, Id explain it? operation, three things musl be 
added to it. nr E £ r 1here must be an indication of what code correspond* to 1he segments reared 1o 
in the, pia*. Second, [-we- m^s 1 : be a ist ng, u1 *h s ; dala flow connective tissue implement 1h* data 
flow required by [he plan type, Similarly, (here must be a hstir-a of the control flaw connective tissue 
which implements the control ilqw required by the plan, 

The resulting structure ia referred to as on applied plan or explanation. It can be used *o 
answer questions about how a particular sejant does what it does, tl should be noted that this is a 
second level OF instantiation^ The firsl level m*ds- explicit 1he structure: {teleologjtal, data fJ& Wj and 
control flow} ol the serjrenl. This level maKes explicit the way in whben the structure is implemented. 
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Segment vHh segmentation intrjrma^Dn 
A Al VNi - FWN1J 

A A2 UNI - XNl+UX 

Applied ol>n fo* the segment 4 additional Inrfornrtlion Only) 
dala I low 

nil* pari Al of A CF} 

x From outside A vi? variable XN1 
into p*r] A2 Of A [+> 

x trorn outside A Vi» variable XN1 
irtt From outside A via vanjbt* DM 
10 oulside of A 

n*wy from part Ai via a ss igninent, and variable YNl 
h*wK from par! A2 via atsigrtmanl, and variable XN1 
corbel How 

(rim oursice A to pa-M AJ via initial placement 
rr*m p*r; Al 10 part A2 via sequential placement 
from pari A 2 IP Outsida vja iinal placement 

Fig. 3 2i This shows the additional in-formation which rr.ust be acded to the 
plan in t-na previous figure m order to maKe i1 an applied plan, Or explanation. The 
segmtntalion in 4 orn-a1ion ij represented alongside (ha example program in the 
same ^as as in Fig. 5, 

This, system uses different methods for the understanding jsnrj manipulalion of each type 0? 
plan, This allows greiT flexibility. This is ortly possible because the number 01 plan types is small. 
The n*nt section descries the essenlial features of the plan types fcunc ,■■ Ifr programs in the IBM 
SSP. 
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1IL3 THE BASIC PLAN TYPES 

The follow:^ wdierre detail fh c str Jdures af lh<? hn^c plan types. The sections are arouped 
<nlO categories based o* 1he way the plans approach decomposition of a goal Each section JojIows 
the same paltern. 

E*$h section starts with a sthenic .representation af how subses^e-rtt* ft! combined in 
accordance, with ihe plan. Arrows in the digram indole typical conlrol How (solid lliw) and dala 
how {dashed l,m*s.J. Control a^d cala fiow are npl part of a plan unless it is applied to * Specific 
program. However, >hg *ay the nub '.es 'rents n^ract highly co-stains tne Fa*m the cats and control 
flow <am take. A "*" Is used to mark, the exil path on wtaeh a predicate assents ils assertions, [t 
asserts the negation of its assertions on |he otter palh. 

Above and below tJie diagrams, equjt ons summarize haw the exlrinsic inputs, Outputs, 
prerequisites, and assertions of the subse&menls cOmbira to produce tht irttNnsk inpuls, otilputs, 
prerequisites^ and assertions of 1he o^-t&r segment. As before, subscripts are L-sed to re^e- to toe 
parts Of the description OS a segment. 6«:ow these are e*p.lici1 e<^s<rrip1iQr,5 OF the purpose (subscript 
PPO of each subsBjmenL 7hr#s* description? in tonjundiGn with Ihe equaliqns indicate 1he (eleological 
S( rue Sure o( the plan. 

To [tie righl of tne diagram, equation* S4ir*marize any ddin.t.prs r-Eeced 1o urderstand 1hc 
Other eaL-flt ions. At the bottom oF the figure, th^re is an e* ample segment of FORTRAN code 
illiKtralins tfls plan lype. Lastly, Uie^e is a section describing the plan 1ype and imitating any points 
of special interest. 

IIL3.1 THE QQAL DECOMPOSITION METHOD "W 

In this strategy, a fioal is divic^d mto pieces which can On achieved in isolation In OrdBr to 
achieve :he goal, e^ch p>ece is achievec scsmr*le y. 

III.3.J.1 THE PLAN TYPE "Ar^C" 
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Fig, 13s Schematic (or, and example of, The plan type AND 



This is the simplest type of plan. N subsegments (with extrinsic names Ai) are additiv e ]y 
comoined to produ.Cs (tie Overall segment (whose intrinsic name is A}. Tnc- purpose of each interna! 
segment is to achieve* ils part of the overall goal. There is no a priori constraint On Ihe order of 
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eaeiuti-on o' 1he interna: sE-grrenii. They do no^ ■nlerii;: in any w*y. to dala Flows between them, 
t should be r.oled lhat tr>e U ni*n of the »)»rti«ns Of Ihe Ai should not he- a sonlradiclion. If it is> 
then what one- tubwg merit it trying to Hhitw jj mcOrnpatable with- what another subsegroent is 
t'y,r- ; :a a:-iiv«. 

IILS2 THE GOAL P£C0MPQ5IT[QN METHOD "XOfi" 

]n this -strategy, a goa: is subimde-d into cases. ]n ard«r to achieve the goal, ,t is determined 
what ]ype of sj;ua1ion e*is1t. Baseo on the type, sn easier goal it achieved which is equivalent in tfie 
pirticuiaj situation. 

1] 1-3,2. 1 THE PLA^J TYPE "CASE XQR - 



A I ■ Uj-i,ii <Pij U All* 
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Pipit - 10 eslablish whether Pi A is 1 rue. 

Alpij - when Pi* is 1rue, thij fsrrjvides She Ag and Ai A . 





IF ([-It 15,5,1? 


= 


X - SINUS 




coro 30 


13 


IF [j-z» 24,15,20 


IS 


X - COS 12 r 




CD TO 30 


23 


S7DP 


33 





Fig. 14i Sternal ic fee, and example of, tha pi a* type CASE XOR 

Depending «n which of n stations iPV is found, tar* of n actions (Ai) will be pertermei It 
mu&t be true 1h*t One and only am of ?h* situations occurs it 1 given lima. This 0&in& the case, 
there is, no restriction On the order in wWcfo the 1es1s are made. Nole that whichever' test is chosen 
to be made last can be Omitted dhough ihis odes no( add te the dirily 3' Ihe codej. 

The tests are made wh pred.canjs, ]r Ihe example, the IV=1 predicate is "3-1-0". The IF 
COnv*rU the segment "M" which outpu's a number into a predicate. \n a given situation, the- 
predicate*, Cascaced together, select Ihe correct Jtbtefcment to use as the- body 0* the CASE XOR. As 
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in [he ANO t>ia subse^m^n^ (At -Art) do no! interact with each other. ]n (act in any one s*ecution of 
a CASE XQR only One of jhs At is elected. 

IT] .3. £.2 THE PLAN TYPE TQOND Kqr* 

A P " A i.l,n t P "»A "• <Pip 1 tPij-AiplJr A (Vi Bl . n Pi A ) 
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goto 3@ 
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Fig. 15: St hematic for, aivd ex*mpl? flf, the pian type COftD XOR 

The CQND XQR it a variant dF the CASE X'OP. II is included hem because it ii e*trem.ely 
comn-^n ar\d because bugs a'ten arise cue to a contusion between 1he too. 3n the COND XQR, Trie 
Qidtr Of execution of Ihe It&fe it nd1 free, il ii essential. 

In a serial ■compuler, 1he 1esls musl be- made in soma order. The OOND XOR takes advanlage of 
this fact to gain two bene fits. Firit !he i realign in which a subsesmpnl Ai is aifeculed ii (Fi fi />. Pi A ) 
not just (Pi A J (actually (his was 1rua with the CASE *QR as well, but since ((XOR ; . l y ^PF A 3 -* 
(PiA-»PNfc}) it was not UStiul). This is useful here be-cause 1he alternate* situations needed to 
subdivide a goal oflen have this kind df fof.it. [n addition I he prerequisite ol the COND KQR require? 
only that Ihe OR (rather than the KOftj of the predicates Pi A be 1rua. This is, In general, more in line 
with 1he way th^T pecpe L™.irr_ ]n ihg oxample, 1he three ii1u*h*n5 are X*S, X>3 ft Y/X^, ? nd K>0 a 
Y/X*£. Using the CO.VD XOR. rather t.*.n- an c^uiva en: CASE XQP, save* duplication of programming 
effort. 

The second £*i n is I hat the perquisites 01 a COM] XOR *re flflen simpler than in an equivalemi 
CASE XOR In I he esample, because ihe ordef of The tests is Fi^ed, the prerequisite of the second 
tes! (that XtB) does not neeo to- be a prerBqias.ta of the wholt COND XCR. Note that, as in the 
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example, the- l??l predicate of » OOMD XOR is c*t«n "true* (naedin& *w code to be impleman1ed) which 
recognizes the S-HuatiOn "&1herwi$e," 

On* of |hi moit cOnvrtfn bugs associated with WR$ ■ * Gut 1C I ha last 1hal programmers often 
implement a COISD XQR when thay have a CASE KGfl in mind, in the example, I he programmer mighl 
have been Jhinkir^ that wneiwvei J^G Mwn error -l and whenever T/XsB then error-£. [T is easy 
not 16 notice that lhi 5 makes no sense since the alternative? ire not mutually exclusive. What 
happen? when ooth alternatives are true? the program makes a.i a - 1>. t,- a - >■ decision Belting error io 
L This m*/ cause a p*cblem iater if some olher program assumes that errp'^2 implies IhaT y/x^B. 



[[[.3.3 THE GOAL DECOMPOSITION UETuCa "COtVF" 

In this strategy {romposilinnj, a goal, is athiavtd one step at a time, 
that afle-r trie sub&Oal i 5 achieved tt is easier to achieve the desired goal. 

IIL3.3,l THE FLAN TYPE "COMP" 



A iubjOai is chosen so 
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tc satisfy Fp-j, to provide F IIh a*d 10 contribute G^x 1fl A^, 
1C provide Aq and Eo contribute F A to A*. 



Z - ABElfcr 
Y « LOGCZ) 

Fig, 16: Schematic For, and example $>i t tha plan 5ype QQkfP 

The sufiseamenl F perFor^s a calculation based on entemal data and on the Ouputs Of the 
Subsegment Q. The inpuls and prerequisite* of F a-e c viced mfc Two sets external (F IX incl F PX > ar*d 
mlernal CFj| arvd F PI J. The interna requi-eme^s are sa' sfieo by the Outputs and assertions, of G. 

The vertical splitting oF the &oai -vai Iwg main benefHs. First,, the prerequisite d the whole 
segment are oiten simpler 1han the prerequisites el F, since some oJ tha later are satisfied by Iho 
as senior:; oh G Wore importantly, the assertions of 1he Outer segmem compose the assertions of F 
and t*. ii the en ample, G n-akes the assertion Z-AfiS[X> and F make; the assertion Y-LOKZJ. Qft*n h 
substitution is used to eiimir,a.tc references to t.Te outputs. Pf u in the assertions GF A. in the example, 
I his would yieas Y-LuGfABSCXJ) « the asserlio.", ol A. 

An important special case c! the plan type COM? oc^rL «<hc' A A equals F ft arid F A tfoes not 
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mcnlicn 1he output ol G. In Shis «« (relerre* 1o as a PRE^ COWP), ih* only function of G in to 
satisfy prerequisites o( F. 



This plan type i s nil -common in- numerical programming. However, it dots occur in the pro^r 
HK1. The lollawing anainpfe r rom the blacks world illustrates the dan tv». 



*n- 



CLEAftTpPfAr 
PUTfflHA.Bi 



Frg. 17: An Sample of the plan type PREP CQMP 

Tha bo#I >t to pul A sn B (3 s assumed to already hjve a. daar Sop). Q which i& CLEAPTQP^A) 
COnlnbutes to this E 0*l Cnty by making F which is PUTOMIA-E) applicable. 

IIL3.4 LOOPS 

The previous sections have described Ihree rn»lhod a lor trmslorrring one go»| into a set of 
easier sub S pals so 1hat achieving 1he steals Khiavss. S-« E o 3 !. T-e plan lypes descr-bed =bov C are 
limited in 1hat, evefl In combing ion, Ihey c*n only he used 1o implement a £0al decomposition method 
when the set q[ ^bgDals e&n be banded in size 41 ihe tun* Ihe program is written. Loops can be 
use-B to implemfrnl unpenned but finite, s*1s Of -subEDals which are sufficiently repel Hive. 

Loops a JB noS a dVforenl goal dtrtiupd-sHion method. They art a different implement a! ion 
method, [t should be noted thai loops are alto often used 10 implement bounded set* ol subgOals 
whith have repel itivc structure. 

There are two ways to approach the de*=riplipn ol 1he pJan type LOOP. Ona could it*r| <rith a 
method tor descr.bir.j. U r»boun«d but finite sets ol subgoals and 5 ho* how they c ,n be implemented 
AMernatfrly, one could slant with Ihe phenomenon ol a loop and show how i| can be hirnttfiiid to do 
uSelul work Each way highlighte inteiesting aspects of the problem. 

Consider & finite but a priori unbounded sel of iubfOais wh ;■- tjm be put in one to One 
correspondence with an initial subsel of tre positive integers s& 1ha1 achieving lh e subgaals in the 
natural order of the corresponding imagers achieve; tha overall jotl. Let G[i] repr CS gn1 the sud^oal 
associated with lha mte a er i {square brackets will he used exclusively to mark items associated wiSh 

Ihe , in ,:B.-a<.on t>t a ocpi T.i P set ol sgbjoals is the* [<%]] G £i]. ... , Oh]}, wnere n .s 1h B 

L-nfcnown numbei of subgoals-. 

Suppose that there is a set ol computation [S[ll _ , i^J -) such that if ;G[3 J h _ , G r i-1]! 

have already oeen achieved, then evettftins Sfij starves D[i]. Further, suppose tha? there i& a set of 

predicates -jr&], _ t T[ij, ...) such that il jG[l]t ... , G[i]] have already been achieved, then e^:u1in S 

L-l wi.l deter, Tire wnelhe- ihe overall a oJS has been achieved, i.e. whelhc* n-i. Sven. this the 

following unbounded computation would achieve the overall £5 ,| and terminal*. whan il has been 

3L'\ I'.-.-VC 




F/e- LBi Schemata J sr the plan for an unbour*ded tomp.uta]lon achievinft |he t(a[i]} 
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The- sequence nf eompulatipnj cannot be implemented in 1he way the abov* (igure augeesla. If 
«ach segment was impltmflntsd separately I he KEiuHirtg program would be infinity -since n is nOl 
known in advance. 

A loop has, the property that i; can orod^e an unbounded »qt*nc* ol computations- iram 4 
finit* amount nf code, 




Fia. 1?: a loop 

The anove. pimp, schematic has loops in control and dala flow, [J it were running, it could dearly keep 
running for an unbounded time, alternately executing S and T. Father, since T it a predict*, it might 
even le-rTiinale. There is a problem .'-Owsver, how would iJ Star I? H appea-i 1ha1 the execution Q\ T 
mi, if always pee cade the execution 61 3 and fast the Buecution or B mus-1 always precede The 
execution of T, 

If the execution of the ioop we.-e already at either poinl X or point Y, then there would be no 
problem. A loop may be initialed by mimicking every reie^nl Feature of the sl»fo 01 1he wo* Id al X 
or a( Y and Ihen proceeding as if En* loop had always been running. What features are relevant 
depend* on ihe nalure of T and B. Clewly, »ny dala iterns which will be used as inputs must be 
crealec. and tho prerequisite? 0^ T ana B ,ik.st be -;*\ sheo. 

The flot-on of mimicry is a powerful one In its own right. It is broughl into nlay whenever two 
d*ta. Or control flow palhs join to$rihi?r to become on*. Thg- joining causei 5h 5 inlQrma:ion about the 
ofigin at the paths, vrhi^h was inherent in (heir separates**, to be lost On 1h c other hand, when 
paths dive-ret, as from a jsr*di«1#, information can b* sneodad in 1he separa1er*5s of the palhs. 

The plan types *"OF?. CCWP, and LCC? approach mimicry and palh convergence in different wjyj, 
In an XOR (see section tJt.3.2) 1he data and conlrol flow p»thv join together a] I ha- bottom Tht 
output a S5P rlions explicitly mention this fact, fn *r1*d they say thai one Of these n thirds happened 
and it can Oe deeded which ore by dclermining which prodcale was tri**. 

In a COMP (see sediOn ![].3.3J there is nOl actually any (dining, of palhs., However, imagining 
that 1here is potenliaily a second control Now afld data flow path directly to F from the Outsider 
provides a conve-niflnl way nf thinking about what ►s happening. ]f e ve r y t h. rr wai Ee § f 0r - in c 
ek«cj1iOn of F, then 1ha direct palh coutf be taken. G crates the required COndiliOns, thereby 
mimjcking the conditions on the direct paths 10 F. Mote 1hat, in ee^ral, F cannot tell whether control 
comas from G or directly (jom toe outside. 

This notion can be extended. Whenever the relevant state it indistinguishable in two places 
and the s.amt subsequent cs-lculalion is deslreO, than a GOTO can be Oono JrOm one place- to th* olher, 
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When the J£ L tr J 'J^ Jl 1 ^? 1 T J"* 1 ° * ^^ '"S™"^. 
have beer, , p |/ n ys I J ^ ^ ^' T0 "* "* * Ver ' "* ful *" '<> '«* -t a p-ooie-n. [1 CO uld 

caution a3 | hH uS^iSm? P ""'" perf&rm & ** cUy ,he s *™ 

«- ^M^K^zl^rSU^ z^r^ ,i! ,hii is * !• ,h - —' th * ™ 

P«Sf*«. H should be noted foil T : Slft*L I ^ ?£? , V "" b * '""P 1 ™^^ ^ f.nite 

to COm py (e . ] fl [„ e unb0l , rt (i d a™r™?h"*L ' ' '^.current one sa thai [he, know what 
it mu5 l h* ™*d rn STvJji 'ntorm,Ti 0B « ccn^d In the l|*w cf <cntral. In a loo,, 
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IIMfl.l THE PtAN TYPE TOOT 



n such 



that 
Aj _ 

A„ . 






«, n CO£U IK U ~(i? T vJ 



f3;-] 









j ~ 



► ■ - 

■ 



T-X 



; 






1 it BW] and optional] Ey T [81 

Tin, - nii IK u niix, 

rtiip - T[ij PK ft rtij PI 

BEiJi - BEil tx u B[j] n 
Btijp - Btilpjc a BIMpj 



Eti 
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Jo 


=> nun 

5 B[l+U If 






t CTtj-J a, Al 

i tTIj> A n 1 



Blj] A M ft BUtl]* - TEi+1) 



"i 









I Bfi - tCmi1ialetholoa-j5ir.fi. 

tUpn * to del ernni rt& it the cgmpuialion should $tep i.e. if n. 
B E t] p B - to peTfnrm the steps pf the calculation. 



23 



K(BJ « ENH 

DO 10 I-1 P [NFIH]TV 

HID - F([,Xa-l>,Y{]J] 

IF {Tll,X{l)»Zlin 20,10,23 
CONTINUE 



X ■ 
IB X . 
IF 

20 . . . 



MBStXtX-181-l.GE-lti] 20,23,15 



Flfc. 20: Schematic for. and Samples a I, the plan typo LOOP 




on* the £ oa, GCl] should b, Sieved >nd the ^"wNr^iu^;^^".^ "" "^ 

Tfts equal ion* shfi W ,n S how she subs* E nenT* inter «1 !a order to create ihp bena- Cr at * I HTiP 

are ample*. Forh.-n.lel,. m«< LOOPa do not take a^taga o, th . iuVcol, e t^TM e fi B u^ ^p 

i™M. uenwnfe are S ,v*n. The Kr.t. which h S5 ™ a , e Qr r e5 , fu|| complexity is s tif Kl and «3 

ter«,r.i T^ aua *„1?tv "^LnT °' ^'^ " det " minin * * h ^ lf ™. a E i,en LOOP wit. 
tU rJ It -ha r V h * hl ^ r*F*'«»nt & the lerminalion poinl, »pp„r S in every BqU at,on Fn d ;* 
Central 10 the understand^ at , LOOP. Tr-. ned Wo ration* t he w how th, problem ot worRi^ with 



Richard C Waters M 3[]3 ThE g A£JC PLAN - vpES 

n tan be split off from the re*1 dE Ihe LOOP. Once isolated n Oflen turns out to be relalively easy to 

LTuJoT-ElariG. 

There are other areas where simplified pi can o««r. These area* r_ould be looked el as 
feature* wtoch a E iv Cn LOOP might or mr 8 h| n «l have. The egressions for the inputs and 
r:rc.- s ^_... .-!=!, *- c o'ten simpMec s a-d/a- T m*y net have any external inpuls nr prerequisites, 
Fai.in S ^, ^ oap-esi or; for A, and/or A p mjv not depeno On n tlhis is 1he case in She second 
example segmin!). 

Very pi ten, the only outputs are Irom the Fist stip. Similarly, |h* assertions may only depend 
on the last s1fcp. Jt should be noted thai picking just the right assertion* For T and 3 so |h»t the 
entire action of tr.e LOOP is summarized at each step to an *rt. Pu1 another ^ay, it will oFlen be very 
hard to prove ihdl a convenient form far th* assertions pi A follow from a convenient form for the 
assertions of T ard 0. Wr-en tated by a dirrieuU prpof, 1his- system wi|[ (U »t ask the us*- whether il is 
possible. [1 he says that it is, 1hr.-, the system w il, trust him. However, .( will rememfcer that the 
assertion may be shown false at a laltr time. 

IIL3A2 THE PLAN TYPE 'ENUMERATION LOOP 

If everything h removed (rem a LOO? e*«pt Sp r the calculation y n , I hen the remaining LCOP 
it in ENUMERATION LOOP. The process described in th. next sethon snows now additional 
tompulalion can Jse added info a LOOP. 

X - 0.0 
DO 20 1-1,183 10 x , c,H] 

20 fJONTiliUE ]f 00 10,20,10 

20 ... 



Ftg. 21: Eyjmples of the pljin type ENUMERATION LOO? 



The schematic fnf this jype of LOO? it identical io that tar the general LOO? except Ihe it doe* 
not produce an/ Output. It just cycles thrown * seque^e of st?1*s. [r dc,r 3 th:* it defines in 
ordered Set Of silultlonfc. Ihe only d.Micully in understanding an ENUWEPATJON LOOP is dotennin.ns 
when it will terminate. Since an ENUMERATION -CDP Itwetically can be aa complex *$ any LOOP, it 
may not ob easy to understand, However, in general when Ihe parts Of a LOOP *hith do no! 
contnbuk- \o l-e talu. si r ,:f n a-, - pDe . = away, (h* £MJrVEflAT]Oi\| LOOP whkh remains is easy to 
understand. Thou e h this type of LOOP saldo.-n appears, as is, in a proeram. il is very important as a 
basis for understanding more complex LOOP* which are built up on lh* basic series of states, it 
enumerates. 

[f an ENUMERATION LOOP is slighlly salended so (hat it returns BMn as ils output then it is 
referred to as a SEARCH LOOP. 
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Eff. 3.4.3 THE PLAN TYPE "AUGMEWED LOOP" 

torn* a mQre GOmp , frK uop. , n tJw fi&urer ,, v ^, ^ ^ ^ ^ ^^ 



i ABji 



J 1ft 



n - L.n 




Aari) [J( ] 
*BlU fA ) 



T - LT 

& = sn AKO of LB and AB 

[ - an AiJD of L, [ and ABtflJ 



LhB[13 q 5 Tliln 

LB[i: y ABIiJg s A£Ul+U n 



,|tTJjJ fl 
ifT( 



j:* 



a LB[j] A t> 
* L.flij] ft >] 

L 



a L.BIl+l] A * TIi+1] 

■* L.arui] pl 



P: 



^ L.B[j] A rt AB[jJ A ]) - ABli+l] p , 



*Ui.B,ii ABEi] a l- 
,rt i.p.ii ABti] A f 

tpp ■ Id in.tiste Ire Ivop rp„ 

T(i] pj . ($ detefinini ij tat tcmpulstion EhoglO s!op I* \t n ~i. 

L.fl [ i > pu . to perform ihe tilctfation for- LOOP L 

AQ [ i i p P . io perlorm the acidsd tte^s of cjI-l at,arv 



00 10 1=1,16 
Iff KIT) = YNf„ZU> 



Z - 1,0 
□D 10 [-1,10 
19 Zr3^ 



Fifi. 22: Schema) ie 1or t and temples of, the pl»n (yp* AUGMELMTEO LOOP 

n*w K^? ,B TK l rNFG * * "S? '* VCJ P(art AS is add,d 1 ° LB <* ^b Sesn »n1 of i ha LOOP L) to tarn a 
- A LB or to T. j mjy „ s6 De n , odMiM 6y the fddihfln Qr . n 



AB 
L 



lahze th* aclions ef 



Th* mc*l important thirtg here i* thai |fc» addilion oF AB to L coes ro; effect i '* 1-rmiutfon If 
01 F s™ C n( a ^ undemanding < 1h . whQ |. „ glBeitf by looking a1 H» inlBriul s ,ril 



Ufft 



BedfliCk ° r n0< ' Th * 9Xamplea '""'"to t". Iwd („.« AMD AUGMENTATION »d COMP 
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AUGMfNTATtpM ]* soth c««. a tonpuMton , E pe,f D rrT,etf, tahi^ *dvan1 aS e q1 ihs sequel of 
states »h, C h IB „i v p Dy 1h . L 00P L, W hi th » UfUi% an ENUMEDAttON LOOP <a B h tie V35J 

]] 1.3.4.4 THE PUN TYP£ "JNTERiCAVED J.COP H 

„.*, ■ Tl ? ^^ tyP f c0THh,nw |WD l-OQPs, K »nd L, sa lh,t the? ar& computed in synchrtiiv Th e 
"^mahnnttrininatHK soon « S H her enelermmalH. ^ro,,. k. 



n - n]N(K.n.L,nl 



U If. 




ICi3 f x tf L.BLiijx u L.TtiJj),] 
TtNpj, * L.6[[]p)i a L + Tti] px ] 



I - K,l U L.t 
T w k.T OR L.T 
3 - K.0 w L.B 



«th LOOP operates 
separately 



>• 






tKxB[i] u L, 



B r i ] ,-, i 
Bti] A ]| 



* K,),„.i K.T(i3 A a L-THUH 
a MCTInU v H..TCrO A ) 

3 PR - Id irii.-^te (he iDDpirtg, 

L, T (U pq - to sie if 1he computation should slop dw* to LOOP L- 
K.T i]pg ■ to sbs it the compulation thoul-d stop due to LOOP A. 
L. 6 [ i .] p B . ;o perlorm the 5 fc e:j5 of th* calculation for LOOP L, 
K. & [ i J PB - to perform the steps of the Cultivation for LOOP K. 





x - 


0,3 








:j 


J-1.10 








x . 


F (Xh 








IF 


(K) 1 •'. 


29 


10 


2a 


CON 

p i- * 


71NUE 







Fig- 23: Schematic for, and example 6F f the plan type INTERLEAVED LOOP 

This if : «lu a lhr« tevel plan, «.T. LJ, K.B ifid LB are eaScuted in M „ order in a rirre. w.fli 

tTfL^'Li'I^ ^ &t ^ Qf f ° Ur P ° in1i - The *° V "1™"* is 1h.l no date flo^ between 
.5 H T i?°m u ^ * n ' y irvC ^ actl<?n is th * **" * ne 1ern.iPii.lK, the o1-H gr is artificially 
Stopped, [t .houfd be *0ted th*S when or* of ite subLCOP* {Say K> te^-nates, t*en the who* LOOP 
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(A) acts in ?ll respects julT I kc- lhal iu^LOOP <K) with wir* additional cumputalien from the partial 
execution ql ih* Other sutjLOQP (U [n pardtubr, the outputs *r# the Outputs [ K with a subset of 
t be outputs el L ao'ded on, 

LiJi* mimicry, interleavine. is a powerJul ide* in, its own right and could oe a separate pJan type. 
Interleaving it essentially a way to simulate parallel processing. Here it hss been reslricted to 
applying only to LCOPs because it « not interesline when applied Is the olher plin types discussed 

One of the mo 5 l It pcrtaat attributes of this plan type is th.i1 it Can be shown to terminate even 
if only one OF the two LODPs K end L can pe shown 1s terminate. As * rtfiult of 1his, this plan lyp? is 
aften uied la bnyns the execution OF a possibiy lOn-lerminati-j LOO 3 with a simple: ENUMERATION 
..COP Itlcc Ihe example}. 

The Olher major use of this pJ*n type is bated On ccmsiderir,B that >l computes eithet K or L 
(whichever completes flratl. Here first is delved In Jtrms 01 Ihe sequence oi slates produced by (he 
LOOPs. This is done in * sMuaJicm wher Bf tor inst>net, t»w rssulls Of L are npf cfesked far perhaps 
art no! computable) if K terminates lies:. The program R*: to.-tain* in example of this, 

In conclusion* it should be noted 1hat <o«ilrOl pails an INTERLEAVED LOOP in two di'rerenl 
Places depending on which lesl iernnn»r fl * ihe LC0P- In ■ grand plan Ihia feature is expressed by 
£Qn 5 iderin B thai the interleaving process join* two LOOPs, each 1 which is the initbl component of a 
co-nple* c0mpu1al.cn. If ihe INTERLEAVED LOOP t^mm^es due Id Jest K.T, then execulien cO^li^ues 
Only in the COmputalion LOOP K is th* milial component ol. 

The splitting ol the How Of control on pxil from an INTERLEAVED LOOP could have been 
eliminated if a component were added Id all LOOPs which was executed aFter the test hjrf terminated 
Ihe looping. This was not done, because i1 was IdT that composing this exil segmen! on the Oulput of 
every LOOP would oosc-ure the hasic ralure o 1 LC0?5. 
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IUA DETERMtNENG THE DESCRIPTION OF A RflQGRiU 

Thit scclion gives sn «ndicati^rt ot hbv 1h e sy B 1em can d^etop an ur*ders1andin e of a program 
m terms C-r 1he des<Y, p r, V E slr^Ves defied n te=: Dn l\l.2. Grvc-, an understand^* of 3 prosran, 
Sector, [J gives an .ridiealmn of how tasks *ffr per J Orihed bv 1he aysteir, 0as cally, tr* &ysEeni eithtr 
just c#p&MB. Diit p.t-15 c.f 1he descriptive itrutture-i, or h*s .EselF a series 0-F quesliGns and perf^ms 
sGme ™,,nfir dedyctiflr-s, The descript^e structure s w C r e SD ec Hie ally des^c-d 10 make the |atk* 
descr bed in setJiq-n ][ easy. 

Sibling, from 1h c tent oi a program, include annotation, s* uncsrs landing J$ developed us-ina 
fitverjf ! y p* 5 $( knowledge. The iyslem has compete k/wvledae «f Ihe basic (acts aboul FORTRAN 
Thus , eludes Knewiedge of (h B spec Hie control flo^ **4 data Flow constats available, and knowing.* 
Of trie basic programs available. The system also fit sO.-ns bask knowledge about maThemaSics. 
Hoover, it should oe nq-Fed 1hal, this ^sla-m does not try 10 uncersFanc [r:S ^^r^ jheorems 
implemented by a prnsram, faut afl | y hftw !he p ^ £r ^ m iwpleflienFa, tht Ihedrerns. FinaUy, the syslem 
has hnowleda* e* what pFan types are used in Ihe programs- in the TBM S£P. 

The urwbrstandine pr <scas& Js .liuilratad by a discussion nf the p/egram CQIWT wWth is ahewri 
in thfr nesl fiawft, 
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H - 111,4 DETERMINING THE DE&CRIPTjQN 

1 C PURPOSE 

3 C £>"« ?inEf? ™ n Srf£LE PRECrSION TO DOUBLE PRECISION 

G S ! " NUhBER PF BDUS IH fMTRICFS 5 4ND 0. 

7 C nnr " SEP ° F C0LU ' 1NS [N ^^ICES S AND D. 

J £ MODE - CQut INDICATIIC TVPE of CONVERSION 

q r l " FR&1 SINGLE PRECISION TO DOUBLE PflEClSlrw 

11 c , lF f1tME " : ' tH[S ^^ CONTAINS SINGLE PRECISION 

» c ? ^t: ***** as *™- « «s s sbss s 

^ c ° " 2L2Hf"k ™ii; A7R !j CDNTA3 ^ QQusLE precision 

1G C ?o™tn?™ S WTPUT - JF r0K - 2 ' [ T CONTAINS DOUBLE 

17 C ?S^ m "™ S AS IN ™" « SIZE DP Sft™ IS 

JJ = "S " 0^ DIGIT ^lER FDR SIfflME riCOE CF IWTRIX 

?fl B - GENERAL 

rf J; i - svitietrii: 

„ p 2 - DIAGONAL 

g £ HATRtX D CANNOT BE IN Th£ SftHE LOCATION A? ruTflrv c 

| c TO^iSE'" " * — --- ™fee,r in 

2* C riETHOD 

33 I.- 

31 SU&qaUTJNE mm W.fl.flQflE^D.hS] 

32 DlrENSlDNSUI.Ofl] -^ U -^ J 

33 Oou&^E PRECISION D 

35 C Ip F iSs-i™^.T ° F "™* ANQ "^ ff WTA mmS 

36 2 N-1-N*ri 

37 GO 70 fi 
33 A Nn-^Vl)*N]/2 
39 GO TO S 

fi C ^ST TVPE OF COWFRSION 

*2 a if uoE-i) ia, is, a@ 

4* 10 D^lstflTJj" 810 " ™ 0<XJBLf PREC1S]0N 

45 lSrjfL)-S(L)' 

46 CD TO 36 

50 C 

51 30 RETURN 

52 EN^ 

Fig. 24: The subroutine CQNVi* 
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The first slep iaken fcy the sysltm i n order to analyse t pro E rarrt »s to d^ide the program into 
control J low, data flow, basic program fragment*, end -commenls. 

1-31 a/* comment and £p.iitar in the p'ecec ng hs-rc 

31 aybnjutine comvt (n^iKJicde^o, r»s|i 

32 dimension aTl> . rf4t) 

33 double- precision d 

3i c find $1orjge mode at matrix a*>d number of data pOJnls 

35 If <ftis-tl Z, 4, 6 

36 5 nw-n*h 

37 £0 ro a 

3* 4 nn» ((n+U*n)/2 

33 CO TO $ 

*# £7 ruim 

*1 c tasl lyp* fl( *0 "version 

42 fl JF f.ncde-lj 20, IS, 23 

*3 c tingle precision la double preeition 

44 J0 JO 13 Ul.rui 

45 J5 rjm.sti) 

^G CO TO $Q 

47 c couble precision to single precision 

4S 20 DO 25 1-1, fin 

49 25 s f I , -d ( I \ 

53 c 

51 3B HUVHfl 

52 end 

Fig. 25: This shows ths subroutine C0MV7 printed in four different 
*tylas oF type. :.-,e sl/ies ol | y?e doHi1y each part at Ene program as either: 
1) FLOJ OF C0HT.H0L CONNECTIVE TISSUE 
Udata flow connective tissue 
3) a basic prop/ an fragment 
Q) c a comment. 

Modulo certain transformations (see sections HI.L3.5 i*d M.1.3.&), this c,v, ¥ , c .n can be dor-e 
Du-ely syntactically. For convenience, entire expressions iue KN+iJdjJtf" have baen taken as basic 
programs m the en ample, The system Will actually only contide- functions Nhe "V, " "FLOAT", array 
indexing, etc. 1o be primitive. Howewe/, it probacy will trial expressions in a special way since they 
are particularly easy to yndorsland. 

II] A 1 CONTROL FLOW 

The control I low d1 a FORTRAN program can be cQmplelely analyzed by Looking at 1he text of 
the program, without any elaborate reasoning. Programs such as optimizing compilers currently 
perJorru such *n%sas. Tns next Jigure is a control 1lQw diagram for 1he program CCNVT. This 
di*8r»rn is a graphs representation «! what the system tnows aboul the control flow of the program. 
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Fia 26: The cCniraJ flow iri (he pra&r im QCft-VT 
SEQ-SECJENT3AL PLACEUE^ JP-iNlTlAL PLACEMENT. 
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Th* diagram is a d Reeled grip- L=:h arc connects One ^Ode Ld one other noda. [1 represents 
the flew Of cOnfrnl oetwBBn the ftodes. Forking of control fkiw arcs is only riasOnable in art 
ervir-cnn-er: wnere thers is asynchronous premising. The label on an arc irtdkales how it is 
implemented. This label Is eitfwr a line number or a direct explanation IF it is a ling number, the 
control flow construct on lhal Ime impuime-n's the control (low indicated by the arc The petiole 
direct explanations include 'SEQUENTIAL PLACEMErfT and "[NSTIAL PLACEMENT." Both Of Shea* refer 
to situations where tne arrangement oi toe staltntfrfltt in the program governs the flow of cOnlrol and 
there U nrj explicit flow of control construct to pont to. 

Wades are labeled wilh an indication of th« activity faking place at th* node. A line number 
indicates Ihe basic program and/or data ISdw which takos place in the ^prtti-ol environment associated 
wilh the node. For eiefrmpiE, 'he tcliem; of line 36 (computinfj HtM arid assjgninj the result to NMJ are 
COrr-outed anly when M5<1, ]f a node I; associatec with erly a pa-t cf a line, t**n it is labBtad with 
the exlrmsic name of ;haJ p*r, pi ihe line. f*r anample, the label "°34.B" on b rode Jntftir** thai Only 
ihe oody, "L-Lfl", of the ENUUSRATJQN LOO?, embocied in line 44, is associated with the *ode. A 
noce at which nolhing happens h nOf represented as a boy. It is just a point at which. *rt arc 
terminates and another begins. 

If more That One art Leases a node, then (h a 1 naoe must be a predicate. Fat example. In* nodes 
labeled: 35, 4Z, 44. T, and flgJ are predicate*. Several arcs can anlar a node. Th, s has no 
extraordinary significance. 

The nodes are associated with the Idwesi >eveJ segmentation of the program. ]n the figure, 
nodes have- Dee-, selected in accordance wilh s line oriented selection of bask urograms. Th* syslom 
would actually product a mora complex diagram in which no reasoning. was required during the node 
selection process. For clarity, (he figure superimposes a higher level of segmental ion on the system's 
diagram (sec Ihe section, on segmentation below). In order to avoid making any decisions About 
segmentate whfe analyzing ihe control how, 5he svslem p^ts in as nvany nodes as t*er ffl are ditlintt 
control environmenls. 

]3!A£ DATAFLOW 

The data How for * FOfiTSAN program cJn also be completely analyzed in a straightforward 
Winner. The ne*t tigure is a etiaejaflv similar lo th* control ilow dia^-an-., representing, the system's 
Knowledge Of 1he d*!a How in Ihe p^o^ram CONVT. 
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Though soffte data (low construct {such a? ^ssignwent) ire directional, man/ {such as variables 
anc subroutine argument*) ars not, These non-diee$t<onal cOnglructs merely mi.int.ain the same value 
a1 sev-tral point?. The conlrol flovy imposes a directionality 0- :-on. The label on an a-c indicalas 
how the data flow il represent is implemented. The label is either a tine numoer dF a dala Now 
<ons1ruct, a variable lime, or a direct explanalion. tf i! is a variable najpe, then that variable 
imple-penls tie data flaw. Greet explanation* are ^ed (0 indicate phenomena which cannot be easily 
.solat F d to One item in Ihe progr-n-ii. The only one used in 1he ligura is m AROf\" which indicates |h*t 
the data flow into or out pi I he pro-am was achieved through subroutine argument posit. On n. 

Unlike com-rcl (low ai ti , data 'low arcs ran fork. Arbitrarily. For Bxavple, the art implemented 
by vjin able KM connects the mignmenl slaleirwnts leaving nodes 3& r 3S t and 40 with the nodes 40..T, 
and q&T. However, a data How path can attyslly only carry one datum f] a time, As a resull, a (JaTum 
which is delivered to 1he rode laoc ed M.T t in 1 given enaction of She node, acluaUy arigin&tea at 
jiiB.1 one Qt the nodes 36, 38, or flfc Many arcs can tnler Si leave a node. This just indicates that 
several dala items are entering c le^vi-g the iwde. 

The dala Mow node* are selected by ihe system in the sime way as control do* nodes are. 
Namely, one for every data (low environment. As betore, the figure Shows a higher level of 
segmentation. 

111.43 SAStC PROGRAM FRAGMENTS 

There are only a limited number ol baaie programs availahEe in FORTRAN. The system hn 
complete intrinsic descriptions of each omt as pari of its «.p«c il ic knowled&O about FORTRAN. These 
desenpt ons embody the lowest level of detaii understood by 1he system. 

IE L4.4 ANlNDTATIQN 

The information dascriOed in the previous thre* sad ions gives a complete picture of I he 
program, a; the Ijnest | frve i OF del ail. The Systen usee this ml srmaS on Id bu-ld up * description of 
the program jtf into-- mediae levels OF structure Lp (o an intrinsic description of the program, as a 
whole. The use or annotation of thl program h rairttiil in this process. Comments and 1hc-T r use wili 
be discussed in aM Of Fhe following sections. 

:t sneu d be -,o1ed fnat this syslem does not tin/ to do any nalural language processing- As « 
result, the ^c-nrenls cannot be used in the exact lorm they tafc* in the programs, in the SBP. It has 
not been decided what form t«e comments will take. The neut iigur* oFtors one au^estion. 

A very isnporlanl question js how much annv.rat(Qn will be required in order lor thr syslem 1o 
develop an untiers^nc ng of a pro^a-n. It appear? t^1 1houg™ 1he ccn-.rr.cr| 5 on Fhe programs in the 
SSP will have to be /ecasl in some ot-.^r form, they contain 5 J? c ent information for understanding. 
As a result, the amount of annotation needed 5'iOLld rial be g^eife.' than the amount a-lready present 
On the actual programs. 
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C partia-l intrinsic tfes-EripNon of OD-WT 
C input?! n, m, isOde, {tWJ, [d^Jf, ms 

C prereojuisitass tlgaTirt* numbers i[zi.\l)} 

C double preusi&n numbers (JdrJiJ)} 

integer 1 numbers, (n. m, maoe, ms|i 
C matrices ([Hi ^jdlitfj 

C rt»NUr^E^_OF_SmvS([E(B)}J-=WJWBER_QF_R0WS(;cKi)}) 

C m- JJUUBER_OF_COHJSMf J3l-!*(i H J-NUUBEP_OF_CQLUMNS{{<l(iH> 

C ms -SIORrtGE „MC£!E( [s{i] J)-ST6flAGE_MG0B {d(i}] ) 

mode c Il p 2] 
oulpulsj en, oni r amodfr, [0t{\)) t \<ni[\}\ t orns 
C asser lion*: I losing number fJio-sG)}) 

integer numbers ton, on-, omode, oris) 
mBlrkei(lDi(i>j ( («!{!})} 

C mod*-! , Jod(iH-OBLS!*(i>J}COWPONErmirV[SE 

C ms4»-£ -. {fe(i)}-SNGLl£dffl}) COMPONENTWISE 

c 

31 SUBROUTINE COTVT {N,M + hQDE.S.Q.n5) 

32 DIMENSION S<i),[J(ll 

33 GQUFJLE PRECIS J DN D 

c 

C the nest segment is of pUn lype XOR 

C partial e*tnr*sk behavioeil dtjcnpttfln Of Ihe nest segment 

C tSMf ticns: OUTPUT-N M&LRJff .ELEMENTS) E*{i>}}-NUkGERJDFJEi.EMEIVTS( id{i>] ) 

35 IF (»1S-1) 2 k 4. 5 

36 2 NM=N*n 

37 CO TO 3 

38 4 M1-(tN+li*Nl/2 

39 CO TO 8 

48 5 ■,.-;■■, 
C 

C (he- nvxt segment is of plan type XQR 

c 

*2 & IF (IKJDE-1) 10, 10, 20 

C 

C £ar1ial Bitrinsic hehaviOral cescription of |h* following segment 

C ssser I ions: {od< i) J-DBL H Js(i J) > DQUFCNENTWl S£ 

C 

44 Ifl DO 15 L-1..NR 

45 15 Q(U-S(l) 
4G CO TO 33 

C 

C partial ewt/iinsic behavioral description of rhs following se-^mtftt 

C assertions; {*sfr)J-BNGL([n(i)}) COMPONENTWISE 

C 

4B 20 DO K L-1.W1 

49 Z5 BCL1-D<L> 

51 30 RETURN 

52 ENC 

FjEl 23: The annotation -On 1he program C0NV7 translated to S term understandable 
by the tyst*m L Indentation tnd^alas segmentation. 
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All Of the information in I he *bOve figure tomes Oirtctly from 1he commenis on 1he actual 
projfim. This section Will discuss (he partial intrinsic Behavioral doicdptiGn for CONVT whrch 
corresponds to the header comment, lines 1-30, 1oaeta«r with linvs 31 -M. It is interesting to nOle 
that line* 32 and 33 eouSd be looked at as comments which hav* bun put in a form which 1he 
FORTRAN compiler can underhand and aol On. The fallowing seeliorss will discuss Ihe internal 
OOmmenls. 

Consider where each part OF Ihe partial intrinsic behavioral description for ODNVT (see Ihe 

frti.rc ebewe) tomes from. Ttv .^L :L ::.-T;;,r f.:.-li ■„■•:. l,nc 31, s^ecf es Ihj: : ■■ ;i-r -r< in ? ..'. s *rd 

Qvlputs. Names for them in the behavioral oescrif lion have been patterned t»t*r (he variable names 
for clarity. The System itself aUaches no jigrti^ante So its internal names. 

This bnn&s up the very interesting topic ol mnemonic names. The variable names are a very 
impo riant source of information about s prog.' am, particularly if there is not mush other annotation. 
Since N, IU, and MS are standafd flam« For NUMBER J^F.RQvVS, NUMBEP_QF_CQLUIv1NJ, and 
STORAGEJVODE respectively, rn the pfoflrams in lh c SSP f additional commutation On I his (act might 
have been omitted if OQMVT was nol so w*ll documented. 

The narne. 0< a variable it usually chosen 1p specify some aspect of the datum carried by the 
variable. This can be used :o ^r.- Rb-sul Ihe assertions of the segment procEudr^ the dalum, and 
aboul the prerequisites of segments usmg il. hbwever, there Is 3 problem with this. A variable is 
usually usee) to carry dl^c-rcnt datum*, in -different parts of ths prosrgm, while 1he mnemo-nro name 
Often applies to Only some of tr-*se da-tums. For example, the variable WM m COrWT is very mnemonic 
when it is carrying lha result of line 36, but nol whers it if carrying the result of line 3S or A$. 

tn sdd'Sion 1o Ihls problem, -sinca 1he system does not understand English, it cannot use the 
mnemonic va | ue ol a n W cirectly. As a resi.lt, the system will probably not use any more 
information from the variable names than FORTRAN uses, namely, Ihe (jd that lha first lelter of a 
vtriabla narne signifies whet.-^r it 15 an integer at floatim* point number. 

Returning to tne header comment, the DEIvEJSIQN stitftmenl, line 32, indfe-atos 1hal S and □ are 
matrices. This fad is specifically recorded in the partial behavioral description, [ n addition S and D 
are referred So at {s<i» and JdfiJ] whan talAing about the entire aggregate. The prerequisites antf 
assertions aoout the data lypes 01 the inputs anc oJpJs come from the nam&s for the variant? ant! 
the DOUBLE PReClStOT statement, line 33. 

The specific information about N h M, US, ,ind MODE is given in tints 5-9 and IS. The information 
apoul what S and are, on output, is given, IhoLgh no! too clearly, in tines 10-1? and 27-29. One 
source Ot confusion is 1hal, unli** the paMial beravier*l description, Ihe commenl does not make j 
Clear distinction between input and Oulpul data carried by the same variable. As a result, when it 
tays "S," it is not tfear wheti-*r t 1* |he \rou\ or the o y t PU 1 data which is oeinj reier.-ed 1o. 

The comnttertti On Jines 24-25 *'* nel used because they do not apply 1o the nternal worKin^s 
Of XhB program CONVT. The very imporUnt tomnenl on Imp £3 is not used oetwse this system 
makes th* simplifying, assumption that variaWes novaj overlap. 

The ptH\al intrinsic behavi&r^l description oenved irom the header -comment is used as a basis 
for the jntrintic behaviorai descnpl ion *F ihe program, [n fact, i1 is almas! complete. The only ihins 
that has to be added it some information iibo^t sP-ne oi 1he oulpuls, Wany commenls are in the iorm 
Of partial behavioral descrrplions, bu1 Jew are anywhere near as compile as a header comment is. 

At (his point, 1he system h* 5 1 good idea cf 1he highesl and lowest level otesci-iplions of the 
c-peratio-n of 1he program, [n order to underttard 1hc program more fully, it must link these two 
cescriptiqns up by determining the inlermediale str^cL.re Ol 1he program. 

SasiCally, il is not 3oo diJfiiult for the system to analyze cne or maybe t-*o levels beyond wh.it 
it unows. An attempt Id go tartar ihan that, wou : d lead to a combinatorial enplosior* as possibilities, 
inlarnal comments In the- p-oG'ah-. -jm n^ ar.n.yiec provide landmarks 50 1hal 1ha systern never is more 
that (wo lavels away from what it knows. 
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[[I.A5 SEGMENTATION 

The (irsl slep in developing an under si anding of the internal workings Of a profirsm is. [o 
properly segment it. The basic did'cully involved m determining segmentation in Iha1 there it a ve^y 
large nurrber of ways that a program «n be divided into segments, Forfcunalely. Ihere- are several 
methods which can be used Jo speed up In* search. 

Firstly the?* are comments which specify segmentation. The enlire program is marked u a 
Segment by being physically separated from ihe o:her programs in [he SS°. Fur:her, it is del neated 
by the SL3R0UT]Nt and END statements, lines 3J and 5Z, for the beneM el the FCPTRAN compiler, 

The po$.i|ion Of intern*) comments lends Id specify internal segmentation, though not 
unam&rguously. The position of ihe comments In CONVT mdicales thai lines 35-40, 44-4&, and 4A-4S 
are segments. It is. harder Us see thai line 41 instate? a segment frdm 42-49, not just lor 42. The 
comment &n line 53 Is particularly interesting in thai it is dearly inlanded solely l& specify 
segmentation, [n 1he East figure* segmejvtetfOn information is indicated by Indentation. This obvi&usJy 
would no! be adequate in a situation where there w#r a Overlapping segments. Jt doe* suffice hero, 
however, 

Secondly, the segmentation can priced incremental ■>■ (for or* Or two levels) from above or 
below. This is done in con^ur^l iOn with recognising p l» n types expressed in the coce (see the npjrl 
section!. If a plan car. be recognized, this automatically give* some aF the segmentation. The reason 
this process can only proceed p-o^^ly f-c-n- I he tos and bcttCrr, a-d rc<\ Iro-r t.-nr middle, is 1har in 
Order lo recogniie th* plan, either the segrrent.Or the subsesments must be determrnad. 

[n C0r-,Vi D'occcdinj from toe boMem can easily detect lhat the expression? ?re segments. 
Working from th* lop, it would not oe 10o hard to notice 1hat the whoir program is a CQvP ol lines 
35-43 and 4?- 49, and that these two i* E men1s are XQRs o1 (35, 36, 3B, and 40 J and {Q2, 44-45, and 
45-49} respectively, tn 1 hi 5 simple example Ihe incremental approach yields a total analysts because 
the program ■* very shallow, 

IIIA6 PLWJS 

The main reason recognition of tne plan, type Ol a segment Is possible is that there ara 0-niy a 
lew plan types used in lha $SP. Tnere are an abundance of features which are very specific in 
differentia ling between these plan types, for instance, all LOOPs, and Only LOOPs, have a loop in 
control and data flow. All, and nisly, LOOPs and XQRs ha^-e precicales. All, and only, CCMP& and 
LOOPs have dala flow between ■uesegtrinnH. tn addition, the subcategories of I he four major plan 
types also have clear icSsnli lying character! slits, 

Of considerable aid to recognition is |he fact that certain FORTRAN construct are 
stereotypic ally used lo implement certain plan types. For stance, ARITHMETIC IFs often implement 
XOSs. DCs Often implement AUGr^ENTED U00Ps h a 00 being an ENUMERATION LOOP. Expressions 
implement secuences 01 CQMPs, 

Finally, tommenls sometiffles gjve an ineicatipn o( the plan lype -of a see m Bnit. The phrases 
"F[ND STORAGE MODE" in line 34 and "TEST TYPE OF COWERS ION" in :ine 41 seem (o indicale that 
the s+jnwnts following trwrn ara XORs. In general, however, comme-nts are no! very helpful for 
discovery the plan type oi a segment, 

III, J. 7 BEHAVIORAL KSCI?IP7I0N5 

The internal comments arc very useful for developing l.^e behsvjr>ra,| deacripSions of the- 
Internal segments. In CONVT, the comment en line 34 indicales thai the output of the following 
jeement is :he njmbe- Ct dene-Is n the arrays. The comment an line d.3 indicates that Ihe Output is 
the DBLE q( tha inpu;. Sirnlarly, the cOrr.ment on line C7 irdicales t-iat r.h c ojtpLl is tne S-^GL of the 
iiojl. 

With some vital -guidar.ee IVot the mternal csmrrents, :rt 4 orm^tion about oehavierel aescr plions 
for the internal segirenls conres up from the intrinsic behavioral descriptions of the primitive 
programs used, and down from [re partial intrinsic behavioTiI descriplinn (or the whole proBrarrt give-n 
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by the header comment. Each p|* n t ype r,^ mlOrm*!i0n about what the intrinsic descripliOn of a 
segment corresponding lo ;haS pmn : >pe must hp if ihe axMnsic behavioral descriptions of the 
Eubsefi-nc^s are known, [r r.~o absenca of a commen: to ?he contrary. 1he extrinsic description o1 a 
segment i s assurec. lo be rr.e sane a& Ihe rkrsic cescription. ]r,forrnj.riOn cannot propagate from 
(he intrinsic behavioral description of 9 segmen1 ]o the extrinsic behavioral descriptions of its 
tub-BeEmant* unless something is known tbOwf the deter [phOns Of these s-ubse^ments. Comments are 
crucial io providing enough i nformat.on about the b#hj*ionl description OF a iubseernenl so thai a 
nor* complete description can be inferred IrOm the description ol the «£menr. This allows ]he hifjh 
level description provided by the heac*r cOmman! ;e be pushed dawn into the program. 

Information filEers up from the primitive pro-jrjms until it meets informal ion filtering down From 
trie header comment. It is at 1he places where these two tyDSs of information meet, tHa! the system 
li required Co perform significant deductions. These oUen take the lOrm of proving that an extrinsic 
O*havioral description, pjrt.iaJly apeciliad by I comment, follows from an intrinsic behavioral 
description, soecMied from below, 



IJ14.8 T-- G3AKD PLAN F$a CONVT 

The previous threa sections Iriefi to E ivi fln idaa of how an understanding of a program i* 
cevelooerJ. This section cuhibils a complete grand pUn for CONVT, ana a discussion of how this 
specific grand plan can be devrlcoec. "he nexl f^ure is. a schematic Of the grand plan for CONVT. 



r G|Aii£XI - 



CONVT (O - 



r-Fl|3b\0 

-A1S3S 

-P2I3S-8 

-A2I36 

-P3|3S>f? 

-A3 



r FlJ42£G 



■F|£HE V J - 



-Al|C[AfiLl 



r 

Y. ' i -■ 



e*t^■i^si€ natte 



LL plan typ 
— intr'insic 



name 



iCf-EOHP 
(BE} -CASE HDfl 
(AALI-AND AUGMENTED LOOP 
(EL1-ENU1EPAT1DN LOOP 



{ 



-P2|42>| 
l-A?|D(AALi -T 



L|E<EU44 

LIE (ELI « 
AB 1 49 



Fig. £9: Schematic of 1Kb grand plan lor COMvT. This is a shorthand 
notation 'or 1 ? diagram o^ 1he ^-a-d pln.i simila' to tr-e Giaarflrns for the plan types 
in section 111,3. This figure shows how Hirj plans are imPed-dtd. The diagrams in 
section tH.3 show whal (he diagram corresponding to each node of the schemalic 
looks like. 



The figure shows how the segments combine to produce J ha program CQ*WT The nexl figure 
shows much of the same information Nil a different form, [n addition, il clearly shows how 1he 
segments relaJe 10 the physical code. 
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1-33 are commenls applying to the whole program. 

SU&RODT&NE; CONVT (N^MGOE.S.D^SI 
DIMENSION S[lt,QU) 
□OLSL= PRECISION 

FJN3 STORAGE .1Q0E DP flATREX ANC NUMBER DF DATA POINTS 
IF \t\h-U 2, 4. B 

2 Nn*N*n 

CD TO S 

4 NH-([N+H*N)/2 
GO TO S 

5 NTi-N 
TE'3T TVPE OF OTWERS1QN 

8 :f mcoE-ii 10, ie, 20 

SINGLE PRECISION TO OGU&4.E PRECISION 

is jo is L-i,iin 

IS 01LJ-BU.1 
GO TO 38 

flOLQLE PRECISION 70 SINGLE PRECISION 
23 00 2& L-l.Nfl 
2% S (D-D (LI 

3@ RETURN 
EM] 

Fig- 30: The program CONVT showing segmentation information. Each line is 
preceded by Ihe intrinsic name of every segmenl containing it (V*CQNVT}. In 
addition, an parentnesis, arc the e*1rinsic name(s) of Lhe segment(s) tto line is. most 
cltisely associated with (if appropriate). 

B9lh figures stop at the level of expression oriented b-*sic segments which, -can easily be built 
up from, the actual primitsve programs. As discussed in the section On segmentation (IJJ.4.5) and on 
plans {[JlA&J r a multiplicity erf factors iilow E the seementltion and plan types tp bs interred. Vos1 
nctebly, ths DO stalejr^nls in lines 44 and 46 indicate the events o1 segrwnls C and D, ard that they 
are AUGMENTED LOOP*. Ths ARITHMETIC IF statements in lines 35 and 42 together wilh the dividing 
and then rejoining character of the control flow digram indicates the *jrtent oF segments A and 3 ano 
that they are CASE KORs. The appearance dI the er>nrroL and data flow diagrams indicates 2 hat tho 
s.e$menl CONVT is a, COMP. 

G^en. She segment *ri*n structure, the system then fiesta Out lha grand plan with behavioral 
descriptions, Ths Jigure at the end of this seeton shows 1he complete grand plan, for CCNVT. The 
•grand plan is l 9 r R c. however, it 5 straightforward-* denvaDle fiom Ihe tent fo-r CONVT, 

All of tne data and control fipw mrormalio^ is derivBd 1r0m the data ard control flow diagrams. 
The intrinsic descriptions OF the basis units (which ire at the end Of the f inure) are- developed rVom 
the- spacitic intrinsic behavioral descriptions of the primitive elements known by the system and used 
■n CONV". Lower levels of detail have been suppressed for simplicity, 

Consider the following scenario tor how the other behavioral descriptions were developed. 
Starling from the t&p, the bask intnn S ;c behavioral description for CONVT Is taken from the heatfer 
e&mmont, A few clauses about the outputs have filtered up horn beiow. Qlherwise, it k the same as 
in the tomm C n3 IransiaSiori figum, The comments on lines 34, 4| p A3, and 47 maKe it possible 10 
prODEgal:© iDx:; of the high le^el information in Ihe inlrinsic behavioral description for CONVT into 
sagmenl B, and So flBshout the pL*n tor Ihe segrYenlL CONvT and B. They do tnis by irdi eating key 
psrts 0( the esfthnsic bahawioral descrip^jons ot fi k B, C, and 0. 

Working, from the bOt10m h Hhere is no difficulty in develop. n E the complete p |art '« r segroenl A. 
Similarly Intto if no difficulty In ds^eJOping the pl^nt for Ihe AND AUGMENTED LOQPs C and 0, A pl* n " 
for the EMUMETftATION LOOP E is included in Ihe tig- 'ft ao that it can be seen how parts Of it are USfrd 
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1o develop the plant to* C and D, (refer lo The section on. AUG^ENTE^ LQQPs 1 1 1.3 A3}. 

It snoutd be noticed, that 1he intrinsic description of tide ENUMERATION LC0- 3 segmenl E diflers 
considerably from th* extrinsic behavioral denript.on 5 of its use in segemenls C end D- This 
difference embodies a theorem yrhich is probably taa difficult for the system to deduce. The fact that 
the prog rammer chose to us* a CO s1atemer.t io .mplemtnt I causes. the system to uto the indicated 
extrinsic behav,qr ? | descriplion. The intrinsic description of I is One that would arise- ■f ihe 
proarsmrner had npl used a Cf> but rather had ©pen coded the LOOP. It is included to E j V « added 
insight mlo 1he plana for LOOPs. 

As discussed in seclion 1D.L.3.&, The array [ndemng ir jres ^5 and 49 has been factored out of 
the- computation into (he data flow. This c*n be dene because, h the p>an for segment £ shOro, I he 
value o! ihe variable L is a function of the number of lilies the loop has been executed, not at ? ny 
data value. This system mskfrs ihis type ol factorization whenever possible. As in this (K e h it usually 
leads- to a significant B^rmplifictTi&n or the staten-enf Of the plans. 

As an ^e sample Of the process Of develops behavioral descriptions, consider segmenl D. The 
□G^n line 4E indoles that lines 4fi and 49 form a segmenl, and thai 1hat segment is a^AUGWENTED 
LOOP. DO is a primitive construel, and so the system immediately produces an intrinsic behavioral 
description ior A < s « ihe intrinsic behavioral description OF segment E In lh« iigura at the end of Ihis 
section). Re1»rrin S to setfiOn :j:.3A|, i1 tan be seer, 1h*t this description tonlorms Id The se-ier.il 
pallorn o! a description of a LOOP, as expressed by the equations in that section, Segment E is an 
ENUMERATION LOOP since it has no o*. I puis. The assertions of E art |UE ( a combination 01 the 
assertions ot i1s body and tesl. 

Because seflrr*nt £ is implemented by a DO. the system knows that 1 he re is an equivalent and 
much mora useful way to stale its asse'liOns. This is ys&d m Ihe extrinsic description, of sesment E 
when, used in sejmenl C j 5ee the figure at ihe end of this section}. Line W can be identified as th* 
AB «aderitiOn„l body! ol the AUGMENTED LOOP, Seciion 1I3.3A3 shows ho* an AS is inlegrated into a 
LOOP in order to <0r m an AuCuEhTED LOOP In ItHsj case, the data How diagram shows thai Ihe AB 
(line 4$i is executed belore (he booy of the or nmai LOO? a,-d takes Ihe output of She previous 
execution o^ Ihat body (the quantity named kfl in the descripl ion of E) as an inpul. This quality Is 
carried; fey Ihe variable L, The asserlio-.i of E Namely Mai k[i]=n-l) shew thai the: value of L ceper-ds 
Only On the number OF iirrws She LOOP has cycled, As a result, the array references an line A3 can be 
factored cul of the computation into She dala 1lnw. This makes, il clear that A3 (line 49} does not feed 
pack to Use ' oecau.it: the [s{i)} are not actually input to it. This implies that D jb, an AND AUGMENTED 
LtXJP, 

Relerrina *£&n Ep sec-lion NI.3A3, (he intrinsic behavioral description of D can easily be 
mferred. The assertions ol D utt just a combination &F Ihe assertions of AB and segment E- The 
assertions fl-F E have actually Oeen omilted except for the fact thai ihe LOO? is executed irom S to 
limit (since k[i] is rvol an output oJ D>. Mole that the only deduction required in 1his whole proems 
was pattern matching and thai Ihere were no1 a large number of blind alleys which th B system had 1o 
lollow. 

The teleolOgical links (see section I3L22} ar* omitted from the ^rand plan due to the lack of a 
reasonable way to represent them, The key deductions ; a fce place when the information propped 
up 1rom belQ* first meets information liltered town From above. This happens at the interface 
between [he intrinsic and extrinsic behaviora] desfripliens of the segmenls A, C r and 0. In Order to 
demon si rate consislency at Thase points the system must use theorems aefin.n& the terms 
■Nmvi@eR_OF_ELEIv£NTS H and *- COMPQNEriTWtS^ 
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P, '.'en: 



Irxr; 



mitri* <{xW}J 

n~NUMEER_0F_ROWE({!tfi>i> 
m = NUkBERjQF.CGL WflStfrii)!) 
*rts -ST0JMiG£_W3OQ (k(I i}1 
ne«NLMBER_QF_ELEMEFJTSl jv(i ) J) 

n>3 

m>3 

ms * (1, 2, 3} 

ms»0 -» ne-ntm 

ms^2 - nc=n 
ne>D 



given: 



1hen: 



ne-NLw3Efl_c _:..Fvrv :.■>■: j;:.=\uwslf_of .elf v<rr;' ■*:■'>•■; :■: 

{NQ>] - F({y(JJJl COMPONENTWISE > A ial , n , jtfl) - Rtfi)) 



Fig, 31: Theorems aboul minces needed (or understanding of CONVT 

The. first Iheprem shows that seamen! A does indeed calculate, the N(JM3ER„0FJELEUENTS in 
:he mill- ces The se-cond theorem shows 1h*r tcgmunls C and D do indeed produce Output* which *Tt 
COMPONENTWISE lunelions of thtir inputs. Thai* deductions ties* thr* gaps between the intrinsic and 
extrinsic behaviorai descriptions of 1hest 1hres segments. 

It is reasonable So empect 1hat 1he system rm&hl fcnOw these theorems a? pari of its. knowledge 
Of matrices, which are the only complex data type in FORTRAN. 51 not, then {he user would either 
have to E<ve them as pari OF the header comment or the System would ask ,ni.v it Ihe deductions 
required aoove W( valid. IF he Stid thay were, then the System would in effect asume these 
theorems 1o be true, though it wouLd na| use 1hen in any Diner 1 context. 

II anywhere along 1he line 1he system discovered any inconsistency in the program, it w-ojld 
report a bug ti discussed «n seel ion H.2. 7r-e profraffl CGNV7 does not hav* any bugs. See section 
LI. 2 lor a ciscuLEion OF tnr* D'ogra.-n RK] which does have buds, 

Finally, in a tidyin; up pnsse, :ne sy*;em propagates low level ^formation all the way up to the 
top, and Mis in gaps in ;he intrinsic behavioral des£rip1ion far Ihe whole program. Jn order not to 
Keep a lot 01 excess information, il only adds in i- formation to fill in conspicuous gaps. ]n this case, 
several of thg outputs 1o the program <such as on, om, and {os(Oi when mode-l) are completely 
unspecified. Data flow analysis sho^s (n»t 1hey are directly mapped from inputs. 

11IA9 TRANSFORMATIONS 

The Only Iransformalion tsee sedion IILU) which was applied 10 produce the program CONVT, 
is factoring cOmp^taFion ou1 of tha ilow o! control. An arithmelic IF wis used to implement several 
predicates a! Once in line 35 and hno 4Z. This it easy for the system 1o spal by looking a1 the control 
flow diegrarr. The system undoes the transformation beFore analyzing the program further. Other 
transformations -can also be identified by clues indicating lhat they ha^e been applied. 

Ir should be slrassed 1ha1 1 r ans \a.'v. pi io~s are a 1 horny issue. It is essential that the system be 
very conservative about applying inverse transformations to a program. If the system experiments 
wjth reversing a large number of transformations which might, have sppfied at any fliven point, i1 w-iFI 
drown in a sea of ahe/native programs. If a large number of Iran* formations have been applied to a 
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proarsm^ commenls will undoubtedly be needed *fr thai the p/g£ram can he unscrambled and 
understood. 

Further, it should 0(f noted, 1M IhOugh a transformation may have been applied to a program 
whilt it was d-gi-ie wr;?;sn, 1hs inverse tr informal ion may nol hawi Jo be applied in ar&bt to 
understand the program, Consider the fDlJowinj; rwo programs which art elated to each olher by 
fact arm j, 

10 Y-SJNtX] 

CfitD 3B 
20 Y-S]HfZ) 

30 

F (J) 15.10,20 
10 VWSINfX) 

GDTO 2Z 
2fi Y-STN(Z) 
30 U-**K 

Tig, 32: Two programs rdattd by lac to* ng, 

The second program $an «« u-rderatooo a* *n AND d1 an XOR and "W-X±X", rather thaJ as a 
transformed XCR 0< 1wO AND*. Only transforation leading to distorted programs not fitting any Plan 
type need be un^ne. r n Lie sCtO-d program, * comrrent might well bs inserted to incitals Iha-t there 
i* a transformatjor, whkh should be undone, Otherwise, there 15 no reason to rn:nn Mat a 
CranslOr.'naliQn his Applied. 
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Fig, 33: The grand plan f&r CONVT 

Plan for saamtnt COlWT which .f * CGMP of G|A *r\d F|B 
extrinsic deseriplion of G|A 
inpu's: t-s,. n, m 

prerequisites: inleger nyrrosrs (ms,, n h m) 
matrices {■;*(!)}, {d(fft) 
n-NUMaEFU)F_TOWS(;s[i:))-NlJMBEft_0F_BOWS(!d(i)}) 

m-*uMBERjDF_coLuuNS': ■ ?•: 1 1 H- M„.y bep_cf_ccluuiss( [d(i ) ;> 

ms *ST0HAGEJ*3OE< J*<i }}J-ST0PAGE JJOOS (cKi )}) 
Dutpuls: lertgth 
a£Lertitjrisj integer number {JefigTh!! 

<»fX&th-MJrJBEK_OF_;LE^NTB({B( j)})-NUMBER JDPJEM MEFfT5( Jd( i}}) 
mapping.: {ma^ty-pe, n++n, m**m ¥ le^glh^iijef) 
aiftrinsie descrioSinn o-F F|3 

JftpytS: {dfift Js(i)}, lenjlh, rtOd< 
p^er't-qidisiSes: floating nvrnfcer'i ({$<■)}) 

double precision nurrfeirfi ([d(f)}) 

malrices ({id)], {{£]]) 

integer numbers (length, mode* 

I* n 3 1 h -NUMBER_0F,E4£UENT&({s(i )}J*NUy BERjO^ElEW ~NTS( [d(i }) J 

mode * [U2\ 
Oulputs: [ocvi}] p [as(i|i] 
MMrtiOns: Floating number; {£o$(i)r) 

double precision numbers ({odti)}) 

milt\ctiilOii\'i} 1 fadErt)* 

mDde-1 * iod(i)}-DBLE{{*(i>]> DQMPOUENTYurSE 

a Jo5(iJ}-{e<0} CQMP1>£NTW[SE 

modai-2 ■* {OsOH-SWSUlcKJJ}) CCMPONEIVrWlBE 

<\ led(l)J-|d[i)) COMPONENTWISE 
mapping: ({dWKd^}, ^M^Wi lenfith^le^th, mode^mode^ 

Jos(i}E«[a*[il], Jod(i>K(j{Ki)}i) 
irlrinsic de-acriphon el CGf\VT 

ifiputS: 1% m r rtWIde, {s<i)|-, (dii)}, DUE 

prerequisites i flo&tihj numter* (fs<i)}) 

double precision nun-br^ ((d^)}) 

mlegex nurrtoer's m, m, mode, msl 

ma1 rices ((&{i>!> Jd[i>-) 

ft-NUMBER_OF_R0WS({s(E)}J-NUh*aER_0P_RDW5({d(lH) 

m-NUkBEfi_Of J0OLL.MV5-: -J s(i )J l-NUk'BE 3_QF_CQLUMN5({d< i}}) 

ms- ETQRAGE_MQOE< f s(i}J)«STQS:AC5LMOOE({d<i}J} 

modn i [I, 2} 
Culputt: an, oris, omodc, [0«Ci)h !*dii» f cms 
*S«riiOn&: floating numbers {J&su'JH 

double precision nurrbera (Jodtf)}) 

integer numbers ion, Om, omode, ami) 

malricestjasti}}, {odd HI 

mode-1 - {od(i)}-DBLE<li(i)]? COMPONENT WISE 

a {oa(i)>{(fi)f COMPOWEIrtWISf 

mode-2 ■* [osffy^N&LtfdG)]) COMPONENTWISE 

a {od[i)]-{<KiH COMPONENTWISE 

orri"fli 
omode -moat 
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dfllfl f ow 

into G|A 



into FJB 



c t r . - 1 - i 



wst (rtro outside COlWT v»a araumSht position $ 

and virtab e- IVS 
n from oulside CQfWT via a/gumenl posiliOn 1 

and variib e N 
iii trcm outsida- oJ CC'WYT vi» argument position 2 

and variab-e W 



len^lh from length (if G|Avia variable Nu 

moc* 1re™ outtid* q* QQtJVT via argument portion 3 

«Ad variable WQDE 
Ji(i)| irern outside oi CONVT via arGumenl position 4 

and variable S 
E*[i>3 from oulside of CQNV7 via argument ponton 5 

and varmtue D 
to outside of CONVT 

On (row outside ol CtfNVT via argumenl p-osJlJOr, l h 

variable M, ane argurftfrnl position 1 
Cm from pu.1 E idn OF COWT via argument position 2, 

variable M, and afgurnen! position 2 
OiriOde irom outside of GQtWT via argumem posilion 3, 

wan able MODE, and argument positiom 3 
cms from su1 side of 50NVT via augment position S, 

variabla UJ. and arguirenl pes i( ion £ 
Wi>) from -Josli)- ol F|B via variable S 

and argument position A 
jodM} from -odfj^ of F|B via variMle D 

and argument position 5 
CCntroS fipw 

tiQni oUside of CCf\VT EO G|A via Atrial placement 
ffo.ni GlA 10 FjiB vn jequenlial pliiemanl 
from Fj3 :& Outsic* ul CCNV? by se^ucnliel p'acemenl 
and RETLRN I me 51 
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PJen Jot s*smen1 A which Is » CASE XC-H of P]|35*3, A!f36, F2P&-3, A2J33, P9I35*?. arid A3 
Butrmsic descriplio-n of PI}35<3 
(1Kb IF line 35 predicates the se&mifrril 3& telune the * branch when results) 

inputs: lype 

prerequisites; integsf number (type) 

output: none 

asstthon-sz iype<3 

mapping: Uype<-argi, ietuit*+feturr*_vali*i) 
entrinsit description of Al|36 

inputs n„ m 

prerequisites: integer number? <n, m) 

oulputs: sue 

asser lions: integer flumbe,' (size) 
si2e=n*m 

mapping: (.nwflrgL, w«arE.2. size«re?yfn_vaiye^ 
exirinsie dencnplion d j P2|3S-9 
(tha ]F line 3E. predicates the segment 35 teking the + brarch wr*en result-9) 

inputs-: type 

prerequisites; integer number vtype} 

Outputs: no-e 

assertions; 1ype-l 

mapping: (Cyp#»+flrgL t resiifllt+re lumbal yed 
eirtfifisic descriplion of A2J33 

inputs; n 

prerequisites: integer number (n> 

oulpuls: size 

assertions: integer number (sire) 
size-((f*»I}*n>/2 

mapping: (n"irgl h n*»arg2, s.izewretyrn_ypluejj 
extrinsk description d1 P3|35>& 
(t-ne IF Mr* 35 p-edmales ;he segment 35 taking the + brjfKt- when resell >£) 

inputs: lype 

prtfttrjuieitBB; integer nun-ber \ type) 

PutDiiLs: none 

assertions: 1ypa>I 

mapping: (lype-irg,]^ 
extrinsic deseripli&n of A3 

inputs: rt 

prerequisites; integer number (n> 

Outpuls: size 

Ksertionis: integer number (size} 
>i z 2 - ' 

mapping; {j$«»**n) 
intrinsic description o( A 

irvpuls: type, n, m 

prerequisites! integer number (type) 

~y-e r -l -* i"iege r numbers {n„ m) 
l/pe-"i -* in1e&er number (n) 
(ype>l ■* integer number (rtj 

oulputs; sire 

assertions: Integer nurrbsr IsizbJ 
typ«<l -+ii£e-n*m 
typ*=L -» aize=Untli*n)/? 
type>] ■+ siae-n 
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data lldw 

into P1|35^S 

t/pa arom outside A vu ■■'Ji'iable MS 
into AIJ35 

n IrOrm oulside A via variable W 

m iffim outtiO* A via va^-able M 
into P2IS5-0 

1ypc f-5n ajtside A vl* varilfcle MS 
into AEP£ 

n iron outsicfo A. via variable IV" 
into P3|35>0 

IvpB From DuUide A vij variable MS 
in Id A3 

n (j*m outside A via vir'itbl* N 
10 OL.ts.iOe of A 

size fccm s .?c OF ftl^S via variable NU 

or fforri *;?» o! A2|3avia variable NM 
or frctr s z* o: A3 via variaole foM 
tonlr'&l flow 

irom outride of A to Pi via initial place r«nt 

irniTt P] |« Al via IF line 35 and label 2 

?ro.i<i PI ^o ?S u.a snared code line 35 

rrom P2 to A2 via :F Imt 35 ?r .d laoel 4 

from P2 to P3 via g»;r#d code hr* 35 

ffprn P3 to A3 via [F line 35 frrvd label 6 

flora Al TO flu Is de dF A via QOTQ Ime 37 and label S 

fiom AJ to culsrde Of A via QQT© lint 33 and label 5 

fr«m A3 Id ou1?ide of A via jjnal placemenl 
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Plan Icr tegmenl B which ►& a CASE KOP tit Pl|42£0, A1|C, f>2|4£>0. and A2jD 
fliftririEJc descriptor, cF P[.j32s<3 

{|h* [F line 42 predicate! the 5c&rr.frnt A2 lading the *b*imh when re-sultSBJ 
inpyts? mode 
pterfrqu«Jtes: in:*aer number (mocej 

mode i [1,21 
Qulputs: rCnc 
assertions: rrsde-1 

snipping: [noat**ttit k rpsulS*relurn_vilue^ 
txlrinsic description o( A1JC 
inpuls: Jfgtn, [sfi}] 
prereqgiiiles: Floating numhe/i ^s!l>)} 
integer number (lengtn) 

Jefljtfl-NJMaefl_aF_xLEUEMrS({tf i) tl-NUMHEH JJF^LEMEWTSf fd( i}}J 
autpu1&: {og(j)£, iori(iJJ 
assertions Jlnalirj numbers ({Os^i})} 

dbuble precision nun-bars <[n<f{ifj) 

matricesf/Jos^, [odfiJJJ 

{oa£i>)-DBLEr.{s(i)}> COUPCNEMTWISE 

a (oriit)-J*(iJJ COMPONENTWISE 
mapping: (iBustlwtlJiHH, |si;i)>{f0ufce(ij], {cdCiiJ-JdiiKDji {osfjlMsMfl 
txlf'tnsit description o1 P2|42>& 

<tn* JF line 42 predicates the segment 42 taking the ■» branch wJi&n results 
inpula: T:?dc 
prerequisites; integer number 1 im&iw} 

mode i [»,£} 
Out puis: no^e- 
assertions: mode-2 

mapping: {mode™argl, Fesult*+fetur'i , %_vali u "ajJ 
extrinsic descriolion of A2JD 
inputs: length, [<Hi)} 
prerequisites: double precision numbers ({dfj)}} 

■nlt^er number (length) 

I ens Hi -NUWBERJ?F_ELf^ENTS^{d(i J3>^NUMBER J CF_ELEWF!NTS({3(i ) j 
Ou1puts: [ni(i)}, [odiOf 
assertions: floating numbers {jos-(L)}) 

double precision numbers ({od(i!"]> 

mat/icei^c-iuS}. fod(i)]> 

{Osii J] -3 N3L< Jcsi , j i) COK/PDVE VTWIS E 

A {Qd(i>HeKi>S COMPONENTWISE 
mapping: (length**iimit h {rtiJJwlsaurMh)}., {o*fi»f (dest(i)il (od^^i))) 
intrinsic description Of B 

inpuSs; mOde h lenglh, {(fi)j, ;d(i)} 
prerequisites: sieger numbers 1mode f length} 

Ifcngth -NUI^BEH J)F_ELEHENTS({L(r)i)-AfcWBER_DF_P-EMEMrS( J<l(0}) 
mode i |1,2) 

mcde»l * f biting, numbers {{a(i)J] 

mOde-2 * double prodnOn numbers {{d(i) f ) 
Gulputs: {ostiJ}. {OctfiJ-J 
asserlions; floating numbers (jos(i)}J 

double precision numbers ({od(iJ}) 

m?trir.eE^as(i)}.. |od(i)}) 

mode-1 -» {od(i)}-DBLE<, f s(iJ}) COUPWJtFifTWISE 

a {es(i]}-{sfi)| COMPONENTWISE 
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made-2 - {05Ji>KNjL({d(i}]} COMPONENT*] fiE 

*x {Od(i)}.jd(i}j COMPONENTWISE 
data flow 

into PlI-^SEfl 

Swilch from aut$tdt 3 via va/isble MODE 
Into AI|C 

fiii)} Ij'cm Outside B via variable 5 
into PJ|42^3 

jwitth from Outeide 3 via variabel fVCC€ 
into A2[D 

{d(i)ji from oulside 9 vii variable D 
10 outside of S 

{□sW] fcom ffltl'i}) OF Al via variable- S 

or fr-om Josfi)] of A2 via variable- S 

{Od(i)} tram JodtiJ] of AJ via variable 3 

Or from [o^i]|- o1 A2 v. a va- ab e D 
Control How 

from outside- of B (0 Plj^Zrf via hnlliil placa-menl 
ffflm Pl|42s8 :o ALJC V ip 11 line 42 and label 10 
f.'OM PI jA?£0 So P2|42>0 vis shared code line fl£ 
from PSJfl2>ff to AZ|£> via EF line 42 9 rd label 23 
from Al 10 oulside of B via GOTO line 46 irsd I abet 39 
from A2 10 Outside of B via final placement 
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Plan tor segmanT C wrhkh is an AND AUGh^yfTED LDOPoF L|E jnd A£|4S 
extrinsic fo&triptinn of L|E 
input&t limit 
Pf*r C q U fsites: inte-^er number (limit) 

limits 
CU^pdti: rtCnc 
assertions: inleger numbers ([Kpjj) 

A Jifl,l i*iit h f'J- |+ i 
m-appirss: (hrniMendvalue, *«4;i> 
Birtrintic description of AB[fl] (part of [} 
inputs; none 
prer-equis-iles; /ipne 
QuFpuli: none 
asse-' lions: none 
mapping: fc) 
cxlrinsk descrjption d1 AB[i]!J5 i-l/D 
inputs: sOurcafi) 

prereQuisiKsE 'JO-ating number (sCurce-U)) 
Outputs.: de*E^| 
assertions: r.oufc.lg p r erisiOn nufn*er {desL(iM 

destW-D&LE<soufce(iM 
capping.: {sourreCiWnum, de.st(i)*dnuin;!i 
intrins-ic description o! C 

inputs; lwiiT,{50uTce(iH 

prerequisites; JlOalins; numbers i-lsu-., '«(.))) 

integer 1 number Qimit) 

limits 

OUlputs: {deslft] 

asitrlions: doubly precision number* ([destdJ-J) 

A l -1 , 1 ini iMt*«0-DBLE(souree(i>) 
fl»t> flow 

into L|E 

limit f/om outside C Mia variable MM 

i",rc ><>■,'■;:«- 

SDuiteii} FrOfn {{sciutfie(i)} which cOmes from outside ftf C 
vi* virltUa EJ-via variable £(L) 
la q jtiidc of C 

{desl(i>j from {the deit(i) ^hjch tOme from dwtfl) 

of {AB[i][4Sj via viable Q(L>J via ^triable D 

CCti'rCl 'lev 

Irorr, outside of C 10 I (LI and AB[B]j vi? milial placement 

I inisiates the LOOP between T and AS 
from T tp AB via DO Irne 44 
from A3 to LB via D? |;ne 44 
from L,B to T »iz DQ tine 44 
from T to. outside OF C via DO U& 44 
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Plan for segment D which ij an A-M3 AU&yENTEC LCOP ot L|E and AB|49 
HKtrin&ie description of ^|f 

inpulS: limit 

prerequisites-! inleger nvmbtr Mmit) 

lirr:i?>3 

Outpuls: nant 

MMrliprres integer numbers iM\]}} 

A t.B.lim;t^[i]-**] 

mapp=n*: <limiWeftd-/alu*, hwk;) 
extrinsic descriptiQ/, of AB[d] (part gF I) 

irputar none 

pferefluiSjtes: rone 

OUlpuEs: rjQne 

assertions: nO"* 

•napping! (;) 
■xlrinsic description Of AB[i][49 i-]„ro 

inputs: sourceCi) 

prerequisites: dOub e precision nyniFjtr (s^urcef.^ 

Outputs-i dei!{i> 

assertions; floating number (deit(O) 

des.t(i}-5<MGLteource(:» 
m-appin^ (5iurce(i)**d#5um J dcst(t) M i*5uim) 
intrinsic description o1 C 

impute: limit,E*our«i!i3} 

prerequisites: double prttisic-n number* ({source^)}'} 

integer numbe* -flimith 

iimn»@ 

Oulpuis: ffiest(i)} 

MStrtiOns: flOaSing numbers, ({desfti))} 

A i * 1 , 1 i n i 1 <d*!l «" >-S!^GLCs*urce(i » 
data flew 

into L|£ 

limit from outside via variable l\'M 
in Id AB~ip$ 

sour(e(iJ from ^saurceti!) which comes IrOm 

outeide vj# variable D) via variable ffiL) 
Id Dutsicse of 

dettfi} fr&m (ihe dest(0 \which wmB trOii des'tfi} 

Of jAEji]|43J via variable SHLJ) via variable S 
COhlrOl f o* 

(rem, outside t>f C 30 1 (L.1 and AEJ&]) via initial placement 

l initiates the LOOP between T and AB 
tram T H* AS via DO line 4S 
from AB to LB vlJ DO I me 33 
From LB to T via 00 line 4B 
from T to out-side of D via 00 line ^5 
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Flirt for segrfWFit E *hi*h is an ENUUEfiATJGN LQQPof ], B, *nd T 
{literally rea i^ec in a 20 linn 44 and in a DO line 45i 

(mapping i f data and conlrql flow are omilted line* She DO itilernenl is sell contained) 
fr*(rin*ic da-seriplion of B[3] (part of t) 

inputs: rion? 

prerequisites: none 

Outpuls: k[@| 

»5sgjtFDf\s: integer number ft[0]} 

«i(1nr.s.C CeSC'iptlOn ot g"j] .-[,03 
rs-l:.: -.[ -l j 

prerequisites} integer nurnba* (kp-ip 

oulptiti: kf,] 

assertions.: mleger number tk[i]] 
k[i>k[i-l]*l 
a-Klrinsic description of T[01 |par1 of J) 
(this predicale is an inherent p*rt of a DO statement) 

ifipute: n^ng 

pr9ieqjis.i1es: none 

outpuls: nor-e 

assert a-,z: n*ne 
eKtrintic descriplian of 7[i] i-l,to 
(thi* prid-icate is an inherent pari d1 a CO staierrantj 

input*: k[ij andvalitt 

prerequisite-t; integer flumben fK r il, andvalua) 

oulputs: none 

assertions-: K[ijie-cvsluo 
intrinsic destnoliqn cF E 

inpuls: endvalus 

prerequisites: integer myifiOer Ifthdvalue) 

Outputs: nyr* 

assertjemj: mteggr numbers ({kji]}) 

A i -l ..n-i^ilstndwaluB 
kjn^endvalue 
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InBrirt-Eic description* 0+ 1h& eajic segments: 35 k 3-&, 3S, flj, 45, and 3$ 
in*riHs-ic oetiiipiiin -03 £s 

f),rprflqu'Sj|tB; mEe&er" number UFBlJ 

Oulputi: return_value 
assertions: integer Aymber" iVelurn^valuH) 
rt I urn_v atue^arj. , - ■ 
intrinsic dascriptici-. of 36- 
irtpu(*3 atf,], n>%Z 

DCtf^nJii'jtfJ^i irj|?--" nrmhrrn hr>r| *r_C?l 

Outpuls: re1urn_value 
assertions: integer number (ffrturrt_vaH») 
'4lurn_value *arg 1 *ar-g2 
intrinsic ■doscriplion o( SB 

JHD^ts: arg I, JrgJ 

prerequisites: intejtr number (argl, <ff2) 

oulpvts: ratufn_vflJue 

assertions: jnleger number (retiafn^yalua) 

retufft_valye«<(air£l+l)«re2)/2 
intrinsic £*escjip.tiOn of AZ 
inpuSi: are] 

pre^equiii1*s: inltggf number 'iargl) 
Qutpuls: reSiirn_valye 
•S»rti«rvs: ifltejer number (relurn^alue) 

retarn_value "9r (j 1-1 
inE^iniic description of 4S 
mpuls: fnum 

are-requisites: floating number Stnum) 
0>u'puts: drtum 
asj#i-|iOn&: double p-recistfln number {dnum) 

drtum-DflLE(inum) 
intrinsic dfesci-jptkir, at Q§ 
inputs: cnum 

prerequisites: double pfetisian number {dnurn} 
atitpuls: tnum 
assertion*: iloaling. number ifftwn) 

tni^ToSNGUdnum) 
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